> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Policies with notactions remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM, follow these steps using the AWS Management Console: 1. Sign in to the AWS Management Console. 2. Open the IAM console. 3. In the navigation pane, click on "Policies". 4. Search for the policy that contains the "NotAction" statement. 5. Select the policy by clicking on its name. 6. In the policy summary page, click on the "Edit policy" button. 7. In the policy editor, locate the statement with the "NotAction" condition that needs to be remediated. 8. Remove the "NotAction" condition from the statement. 9. Review the remaining conditions and ensure they are correct and aligned with your intended permissions. 10. Click on the "Review policy" button to validate the changes. 11. Review the policy summary page to verify that there are no errors or warnings. 12. Click on the "Save changes" button to apply the remediation. Once the policy is saved, the misconfiguration of having "NotAction" in the statements will be resolved. It is recommended to thoroughly review the policy to ensure that the desired permissions are correctly defined and that the policy aligns with your security requirements. # To remediate the misconfiguration of policies with NotAction in the statements in AWS IAM using AWS CLI, follow these steps: 1. Identify the policies that contain NotAction in their statements. You can use the AWS CLI command `list-policies` to list all the policies in your AWS account. ```bash theme={null} aws iam list-policies ``` Note down the ARN or name of the policies that have NotAction in their statements. 2. Retrieve the policy document for each identified policy using the AWS CLI command `get-policy-version`. Replace `` with the ARN of the policy you want to retrieve. ```bash theme={null} aws iam get-policy-version --policy-arn --version-id v1 ``` Note down the `Document` field value from the command output, as it contains the policy document. 3. Edit the policy document to remove the NotAction statement. You can use a text editor or a JSON editor to modify the policy document. Remove the `NotAction` field from each statement that contains it. For example, if the policy document looks like this: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "NotAction": "s3:GetObject", "Resource": "arn:aws:s3:::example-bucket/*" } ] } ``` Modify it to remove the `NotAction` field: ```json theme={null} { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] } ``` 4. Once you have edited the policy document, save the changes. 5. Update the policy with the modified policy document using the AWS CLI command `create-policy-version`. Replace `` with the ARN of the policy you want to update, and `` with the path to the modified policy document JSON file. ```bash theme={null} aws iam create-policy-version --policy-arn --policy-document file:// --set-as-default ``` This command creates a new version of the policy with the modified policy document and sets it as the default version. 6. Verify that the policy has been updated by checking the policy version using the AWS CLI command `get-policy-version`. Replace `` with the ARN of the policy you updated. ```bash theme={null} aws iam get-policy-version --policy-arn --version-id v2 ``` Ensure that the `Document` field in the output matches the modified policy document. 7. Repeat steps 3-6 for each policy identified in step 1 that contains NotAction in its statements. By following these steps, you can remediate the misconfiguration of policies with NotAction in the statements in AWS IAM using AWS CLI. To remediate the issue of policies with NotAction in the statements in AWS IAM using Python, follow these steps: 1. Install the required dependencies: * Install the AWS SDK for Python (Boto3) using the command: `pip install boto3` 2. Configure your AWS credentials: * Open the AWS Management Console and go to the IAM service. * Create an IAM user with the necessary permissions to modify IAM policies. * Generate an access key and secret access key for the IAM user. * Configure your AWS credentials by running the command: `aws configure` and provide the access key, secret access key, and region. 3. Write a Python script to remediate the misconfigured policies. Below is an example script: ```python theme={null} import boto3 def remediate_policies(): # Create an IAM client iam_client = boto3.client('iam') # List all the policies in IAM response = iam_client.list_policies() # Iterate through each policy for policy in response['Policies']: # Get the policy details policy_arn = policy['Arn'] policy_version = iam_client.get_policy(PolicyArn=policy_arn)['Policy']['DefaultVersionId'] policy_document = iam_client.get_policy_version(PolicyArn=policy_arn, VersionId=policy_version)['PolicyVersion']['Document'] # Check if the policy contains a NotAction statement if 'NotAction' in policy_document['Statement']: # Remove the NotAction statement from the policy policy_document['Statement'].pop('NotAction') # Update the policy with the modified document iam_client.create_policy_version( PolicyArn=policy_arn, PolicyDocument=policy_document, SetAsDefault=True ) print(f"Policy {policy_arn} has been remediated.") remediate_policies() ``` 4. Run the Python script: * Save the script in a file, for example, `remediate_policies.py`. * Open a terminal or command prompt and navigate to the directory containing the script. * Run the command: `python remediate_policies.py`. The script will iterate through all the policies in your AWS account and remove the NotAction statement from any policies that contain it. The modified policies will be updated with the new version, replacing the old version. ```hcl theme={null} data "aws_iam_policy_document" "EXAMPLE_EXPLICIT_ACTIONS" { statement { sid = "EXAMPLE" effect = "Allow" # Replace PRINCIPAL_ARN_OR_WILDCARD with the ARN(s) or "*" you actually need principals { type = "AWS" identifiers = ["PRINCIPAL_ARN_OR_WILDCARD"] } # EXPLICITLY list the actions the workload requires, instead of using NotAction # Replace SERVICE:ACTION entries with the exact actions your workload needs actions = [ "SERVICE:ACTION_1", "SERVICE:ACTION_2", "SERVICE:ACTION_3", ] # Replace RESOURCE_ARN(S) with the specific resources the policy should apply to resources = [ "RESOURCE_ARN_1", "RESOURCE_ARN_2", ] } } resource "aws_iam_policy" "EXAMPLE_POLICY" { name = "EXAMPLE_POLICY_NAME" description = "Policy with explicit allowed actions; no NotAction" # NOTE: Changing this document forces replacement of the policy resource. # Any attachments (roles/users/groups) must reference the new policy ARN. policy = data.aws_iam_policy_document.EXAMPLE_EXPLICIT_ACTIONS.json } resource "aws_iam_role_policy_attachment" "EXAMPLE_ATTACHMENT" { role = "EXAMPLE_IAM_ROLE_NAME" # replace with your IAM role name policy_arn = aws_iam_policy.EXAMPLE_POLICY.arn } ``` `terraform plan` should show that the `aws_iam_policy.EXAMPLE_POLICY` resource is being replaced (destroyed and created) to swap the old `NotAction` statement for the new explicit `actions` list, plus any necessary updates to attachments that now point to the new policy ARN.