AWS Account Should Not Have Too Many Admins
More Info:
Your AWS account has too many admins.Risk Level
LowAddress
Security, Operational MaturityCompliance Standards
CBPTriage and Remediation
How to Prevent
Using Console
Using Console
To prevent having too many administrators in AWS IAM using the AWS Management Console, follow these steps:
-
Review IAM Users and Groups:
- Navigate to the IAM Dashboard in the AWS Management Console.
- Click on “Users” to review the list of IAM users.
- Click on “Groups” to review the list of IAM groups.
-
Identify Admin Privileges:
- For each user and group, check the attached policies.
- Look for policies that grant administrative privileges, such as
AdministratorAccess.
-
Limit Admin Access:
- Reduce the number of users and groups with the
AdministratorAccesspolicy. - Assign more restrictive policies that grant only the necessary permissions for specific tasks.
- Reduce the number of users and groups with the
-
Implement Least Privilege Principle:
- Create custom policies that provide only the permissions required for users to perform their job functions.
- Regularly review and update these policies to ensure they align with current needs and security best practices.
Using CLI
Using CLI
To prevent having too many administrators in AWS IAM using the AWS CLI, you can follow these steps:
-
List Current IAM Users and Their Policies:
First, identify all IAM users and their attached policies to understand who has administrative privileges.
-
Identify Users with Admin Access:
Check which users have policies that grant administrative access. Look for policies like
AdministratorAccess. -
Create a Least Privilege Policy:
Create a custom policy that grants only the necessary permissions instead of full administrative access.
-
Attach the Least Privilege Policy and Detach Admin Policy:
Attach the newly created least privilege policy to the necessary users and detach the
AdministratorAccesspolicy.
Using Python
Using Python
To prevent having too many administrators in AWS IAM using Python scripts, you can follow these steps:
-
List All IAM Users and Their Policies:
Use the
boto3library to list all IAM users and their attached policies. This will help you identify users with administrative privileges. -
Identify Admin Policies:
Check if the policies attached to users grant administrative privileges. Typically, the
AdministratorAccesspolicy is used for admin privileges. -
Set a Limit on the Number of Admins:
Define a threshold for the maximum number of admin users allowed. If the number of admin users exceeds this threshold, log a warning or take appropriate action.
-
Automate the Monitoring Process:
Schedule this script to run periodically using AWS Lambda and CloudWatch Events to ensure continuous monitoring and compliance.