Principals with inline policies
More Info:
Using inline policies is a bad practice.Risk Level
HighAddress
SecurityCompliance Standards
CBP,AWSWAF,AWSSSBTriage and Remediation
Remediation
Using Console
Using Console
None
Using CLI
Using CLI
To remediate the misconfiguration of principals with inline policies in AWS IAM using AWS CLI, follow these steps:
-
Identify the principals with inline policies:
- Run the following AWS CLI command to list all IAM users with inline policies:
- Run the following AWS CLI command to list all IAM roles with inline policies:
- Run the following AWS CLI command to list all IAM users with inline policies:
-
Create managed policies for the inline policies:
- For each IAM user with inline policies, create a managed policy using the following AWS CLI command:
Replace
<policy-name>with a suitable name for the policy and<policy-document.json>with the JSON document containing the inline policy. - For each IAM role with inline policies, create a managed policy using the same AWS CLI command.
- For each IAM user with inline policies, create a managed policy using the following AWS CLI command:
-
Attach the managed policies to the principals:
- For each IAM user, attach the managed policy using the following AWS CLI command:
Replace
<user-name>with the IAM user’s name and<policy-arn>with the ARN of the managed policy. - For each IAM role, attach the managed policy using the same AWS CLI command.
- For each IAM user, attach the managed policy using the following AWS CLI command:
-
Verify the remediation:
- Run the following AWS CLI command to list all IAM users and their associated managed policies:
- Run the following AWS CLI command to list all IAM roles and their associated managed policies:
- Run the following AWS CLI command to list all IAM users and their associated managed policies:
Using Python
Using Python
To remediate the misconfiguration of principals with inline policies in AWS IAM using Python, follow these steps:
-
Identify the principals with inline policies:
- Use the AWS Identity and Access Management (IAM) service to list all the IAM users, groups, and roles.
- For each principal, check if they have any inline policies attached.
-
Create managed policies:
- Analyze the inline policies and identify their permissions and resources.
- Create managed policies in AWS IAM using the
boto3Python library. - Assign the appropriate permissions and resources to the managed policies.
-
Detach inline policies:
- For each principal with inline policies, use the
boto3library to detach the inline policies. - Keep track of the detached inline policies to later attach them as managed policies.
- For each principal with inline policies, use the
-
Attach managed policies:
- For each principal, attach the corresponding managed policies created in step 2 using the
boto3library. - Ensure that the managed policies provide the necessary permissions and resources required by the principals.
- For each principal, attach the corresponding managed policies created in step 2 using the
-
Update your code or infrastructure-as-code templates:
- If you have any code or infrastructure-as-code templates that reference the inline policies, update them to use the managed policies instead.
- Replace the inline policy references with the corresponding managed policy ARNs.
-
Test and validate:
- Test the remediated IAM configurations thoroughly to ensure that the intended permissions and resources are still accessible.
- Validate the permissions and resources for each principal to ensure they align with the desired access levels.
-
Monitor and enforce best practices:
- Regularly monitor your AWS IAM configurations to identify any new instances of principals with inline policies.
- Enforce best practices by using managed policies instead of inline policies wherever possible.