> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Suspicious access to data services ### More Info: IAM Roles with suspicious access to data services. Your team should be aware of this. ### Label Indicates that the role is assumable by a compute service and has broad access to S3 data. ### Risk Level High ### Address Security ### Compliance Standards CBP ### Evaluation Criteria A role is flagged when **both** of the following conditions are met: * The role is trusted by one of the following compute service principals: `ec2.amazonaws.com`, `eks.amazonaws.com`, or `rds.amazonaws.com`. * The role has policy statements containing any S3 action (matching the pattern `s3:*`). ### Triage and Remediation ### Remediation To remediate suspicious access to data services in AWS IAM, you can follow these steps using the AWS Management Console: 1. Sign in to the AWS Management Console ([https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/)). 2. Go to the IAM dashboard by selecting "Services" in the top menu bar, searching for "IAM," and then clicking on "IAM." 3. In the left navigation pane, click on "Policies" and review the existing policies to ensure there are no unauthorized permissions. 4. Identify the policy that grants suspicious access to data services. You can search for the policy name or review the policies attached to the user, group, or role associated with the suspicious access. 5. Click on the policy name to open its details. 6. Review the policy document to understand the permissions it grants. Look for any suspicious or unnecessary permissions related to data services. 7. Click on "Edit policy" to modify the policy document. 8. Remove any suspicious or unnecessary permissions by deleting the corresponding statements from the policy document. Be cautious while removing permissions to avoid disrupting legitimate access. 9. After removing the unnecessary permissions, click on "Review policy" to validate the changes. 10. Review the changes and ensure that the policy now only grants the required permissions for data services. 11. Click on "Save changes" to apply the modified policy. 12. Once the policy is saved, go back to the IAM dashboard by clicking on "Dashboard" in the left navigation pane. 13. Review the users, groups, or roles associated with the suspicious access and ensure they have appropriate policies attached. 14. If any users, groups, or roles have been granted excessive permissions, modify their policies accordingly by following the same steps mentioned above. 15. Regularly monitor and review the IAM policies to ensure that only authorized and necessary permissions are granted to users, groups, and roles. By following these steps, you can remediate suspicious access to data services in AWS IAM and ensure that only authorized access is granted to your resources. # To remediate suspicious access to data services in AWS IAM Deep Dive using AWS CLI, follow these step-by-step instructions: 1. Identify the suspicious access by reviewing the AWS CloudTrail logs or any other relevant security logs. 2. Determine the IAM user or role associated with the suspicious access. 3. Open the AWS CLI on your local machine or the AWS Management Console. 4. Authenticate with your AWS account credentials using the `aws configure` command or by providing temporary credentials if using an IAM role. 5. To disable the suspicious IAM user or role, run the following command: ``` aws iam update-login-profile --user-name --no-password-reset-required ``` Replace `` with the name of the suspicious IAM user. 6. To delete the suspicious IAM user or role, run the following command: ``` aws iam delete-user --user-name ``` Replace `` with the name of the suspicious IAM user. 7. If the suspicious access is associated with an IAM role, you can modify the role's trust policy to restrict access. Run the following command to update the trust policy: ``` aws iam update-assume-role-policy --role-name --policy-document file://path/to/policy.json ``` Replace `` with the name of the suspicious IAM role, and `file://path/to/policy.json` with the local file path containing the updated trust policy JSON. 8. Review and update the IAM policies associated with the IAM user or role to ensure they only have the necessary permissions. Run the following command to update the IAM policy: ``` aws iam put-user-policy --user-name --policy-name --policy-document file://path/to/policy.json ``` Replace `` with the name of the suspicious IAM user, `` with the name of the policy to update, and `file://path/to/policy.json` with the local file path containing the updated policy JSON. 9. Monitor the logs and security events to ensure that the suspicious access has been remediated successfully. It is recommended to investigate the root cause of the suspicious access and take additional security measures to prevent similar incidents in the future, such as enabling multi-factor authentication (MFA) and implementing strong password policies. To remediate suspicious access to data services in AWS IAM (Identity and Access Management) using Python, follow these steps: # Get the policy document policy\_version = iam\_client.get\_policy(PolicyArn=policy\_arn)\['Policy']\['DefaultVersionId'] policy\_document = iam\_client.get\_policy\_version(PolicyArn=policy\_arn, VersionId=policy\_version)\['PolicyVersion']\['Document'] ```python theme={null} def review_and_adjust_policy(policy_arn): # Update the policy with the modified document response = iam_client.create_policy_version( PolicyArn=policy_arn, PolicyDocument=policy_document, SetAsDefault=True ) print(f"Policy {policy_arn} updated.") def main(): # Specify the ARN of the IAM policy to review and adjust policy_arn = 'your-policy-arn' # Review and adjust the IAM policy review_and_adjust_policy(policy_arn) if __name__ == "__main__": main() ``` Replace `'your-policy-arn'` with the ARN of the IAM policy you want to review and adjust.