Groups Without Users Should Be Removed

More Info:

Empty groups should be cleaned up and should not linger around.

Risk Level

Informational

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Prevention

How to Prevent

Using Console

To prevent the misconfiguration of having groups without users in AWS IAM using the AWS Management Console, follow these steps:

1. Regularly Review IAM Groups:

   • Navigate to the IAM Dashboard in the AWS Management Console.
   • Click on "Groups" in the left-hand navigation pane.
   • Regularly review the list of IAM groups to identify any groups that do not have any users assigned to them.

2. Implement Group Usage Policies:

   • Establish and enforce policies within your organization that require IAM groups to have at least one user or role assigned to them.
   • Ensure that any new group created has a clear purpose and assigned users or roles.

3. Automate Group Monitoring:

   • Set up AWS Config rules to monitor IAM groups and detect groups without users.
   • Use the AWS Config rule "iam-group-has-users-check" to automatically check for groups without users and flag them for review.

4. Scheduled Audits:

   • Schedule regular audits (e.g., monthly or quarterly) to review IAM groups and ensure compliance with your group usage policies.
   • Document the audit process and findings to maintain a record of compliance and actions taken.

By following these steps, you can proactively prevent the misconfiguration of having groups without users in AWS IAM.

Using CLI

To prevent the misconfiguration of having IAM groups without users in AWS using the AWS CLI, you can follow these steps:

1. List All IAM Groups: Use the following command to list all IAM groups in your AWS account. This will help you identify which groups exist.

   aws iam list-groups

2. Check Group Membership: For each group, check if there are any users associated with it. Replace <group-name> with the name of the group you want to check.

   aws iam get-group --group-name <group-name>

3. Automate the Check: Create a script to automate the process of checking each group for users. Here is a simple example in bash:

   for group in $(aws iam list-groups --query 'Groups[*].GroupName' --output text); do
       users=$(aws iam get-group --group-name $group --query 'Users' --output text)
       if [ -z "$users" ]; then
           echo "Group $group has no users."
       fi
   done

4. Policy to Prevent Empty Groups: Implement a policy or governance rule within your organization to ensure that IAM groups are regularly audited and empty groups are either populated with users or removed. This can be enforced through periodic reviews and automated scripts.

By following these steps, you can prevent the misconfiguration of having IAM groups without users in AWS using the AWS CLI.

Using Python

To prevent the creation of IAM groups without users in AWS, Azure, and GCP using Python scripts, you can follow these steps:

AWS (Amazon Web Services)

1. Install Boto3 Library: Ensure you have the Boto3 library installed to interact with AWS services.

   pip install boto3

2. Create a Python Script to Check and Prevent Empty Groups:

   import boto3
   
   iam = boto3.client('iam')
   
   def prevent_empty_groups():
       groups = iam.list_groups()['Groups']
       for group in groups:
           group_name = group['GroupName']
           users = iam.get_group(GroupName=group_name)['Users']
           if not users:
               print(f"Group {group_name} is empty. Please add users or remove the group.")
               # Optionally, you can delete the group here
               # iam.delete_group(GroupName=group_name)
   
   prevent_empty_groups()

Azure (Microsoft Azure)

1. Install Azure Identity and Management Libraries: Ensure you have the Azure Identity and Management libraries installed.

   pip install azure-identity azure-mgmt-authorization

2. Create a Python Script to Check and Prevent Empty Groups:

   from azure.identity import DefaultAzureCredential
   from azure.mgmt.authorization import AuthorizationManagementClient
   
   credential = DefaultAzureCredential()
   subscription_id = 'your-subscription-id'
   client = AuthorizationManagementClient(credential, subscription_id)
   
   def prevent_empty_groups():
       groups = client.groups.list()
       for group in groups:
           group_id = group.id
           members = client.group_members.list(group_id)
           if not list(members):
               print(f"Group {group.display_name} is empty. Please add users or remove the group.")
               # Optionally, you can delete the group here
               # client.groups.delete(group_id)
   
   prevent_empty_groups()

GCP (Google Cloud Platform)

1. Install Google Cloud IAM Library: Ensure you have the Google Cloud IAM library installed.

   pip install google-cloud-iam

2. Create a Python Script to Check and Prevent Empty Groups:

   from google.cloud import iam_v1
   
   client = iam_v1.IAMClient()
   
   def prevent_empty_groups():
       groups = client.list_groups()
       for group in groups:
           group_name = group.name
           members = client.list_group_members(group_name)
           if not list(members):
               print(f"Group {group.display_name} is empty. Please add users or remove the group.")
               # Optionally, you can delete the group here
               # client.delete_group(group_name)
   
   prevent_empty_groups()

Summary

1. Install the necessary libraries for AWS, Azure, and GCP.
2. Create a Python script to list all IAM groups.
3. Check if each group has users.
4. Print a warning message if a group is empty, and optionally delete the group.

These scripts will help you prevent the creation of empty IAM groups by checking for users and alerting you if any group is found to be empty.

Cause

Check Cause

Using Console

1. Log in to the AWS Management Console and navigate to the IAM dashboard.
2. In the IAM dashboard, click on "Groups" in the left navigation pane. This will display a list of all the IAM groups in your AWS account.
3. Click on each group to view its details. In the "Users" tab, you can see the list of users associated with that group.
4. If the "Users" tab is empty, it means that the group does not have any users associated with it and should be removed.

Using CLI

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to execute IAM related commands.

2. Once the AWS CLI is set up, you can list all the IAM groups in your AWS account by running the following command:

   aws iam list-groups

   This command will return a JSON object that contains information about all the IAM groups in your AWS account.

3. To list all the users in a specific IAM group, you can use the following command:

   aws iam get-group --group-name GroupName

   Replace 'GroupName' with the name of the IAM group you want to check. This command will return a JSON object that contains information about the IAM group, including a list of its users.

4. If the 'Users' array in the returned JSON object is empty, it means that the IAM group has no users. You can use a Python script to automate this check for all IAM groups. Here is a simple example:

   import json
   import subprocess
   
   # Get the list of all IAM groups
   groups = json.loads(subprocess.getoutput('aws iam list-groups'))
   
   for group in groups['Groups']:
       # Get the details of the group
       group_details = json.loads(subprocess.getoutput(f'aws iam get-group --group-name {group["GroupName"]}'))
   
       # Check if the group has no users
       if not group_details['Users']:
           print(f'The group {group["GroupName"]} has no users.')

   This script will print the names of all IAM groups that have no users.

Using Python

1. Install the necessary Python libraries: Before you start, you need to install the AWS SDK for Python (Boto3) which allows Python developer to write software that makes use of services like Amazon S3, Amazon EC2, etc.

pip install boto3

2. Set up AWS credentials: You need to configure your AWS credentials. You can do this by creating the files ~/.aws/credentials. At the very least, the credentials file should specify the access key and secret access key. To specify these for the default profile, you can use the following format:

[default]
aws_access_key_id = YOUR_ACCESS_KEY
aws_secret_access_key = YOUR_SECRET_KEY

3. Write a Python script to list all IAM groups and check if they have any users:

import boto3

# Create IAM client
iam = boto3.client('iam')

# List groups
response = iam.list_groups()

# For each group
for group in response['Groups']:
    # Get the group name
    group_name = group['GroupName']

    # List users in the group
    users_response = iam.get_group(GroupName=group_name)

    # If the group has no users
    if not users_response['Users']:
        print(f'Group {group_name} has no users.')

4. Run the Python script: You can run the Python script using any Python environment. If the script prints out any group names, those groups have no users and should be removed. If the script doesn't print out anything, then all groups have at least one user.

Remediation

Remediation

Using Console

To remediate the "Groups Without Users Should Be Removed" misconfiguration in AWS using AWS console, you can follow these steps:

1. Open the AWS Management Console and navigate to the Identity and Access Management (IAM) service.

2. In the left navigation pane, click on "Groups".

3. Identify any groups that do not have any users assigned to them.

4. Select the group(s) that do not have any users assigned to them.

5. Click on the "Group Actions" dropdown menu and select "Delete Group".

6. Confirm the group deletion by clicking "Yes, Delete" in the pop-up window.

7. Repeat steps 3-6 for any other groups without users.

By following these steps, you will have successfully remediated the "Groups Without Users Should Be Removed" misconfiguration in AWS using the AWS console.

Using CLI

To remediate the misconfiguration "Groups Without Users Should Be Removed" in AWS using AWS CLI, follow the below steps:

1. Open the AWS CLI and run the following command to list all the groups in your AWS account:

   aws iam list-groups

2. Identify the groups that do not have any users associated with them.

3. Run the following command to delete the group:

   aws iam delete-group --group-name <group-name>

   Replace <group-name> with the name of the group that you want to delete.

4. Repeat steps 2 and 3 for all the groups that do not have any users associated with them.

5. Verify that all the groups without users have been deleted by running the following command:

   aws iam list-groups

   This should return a list of groups that have at least one user associated with them.

By following the above steps, you can remediate the misconfiguration "Groups Without Users Should Be Removed" in AWS using AWS CLI.

Using Python

To remediate the misconfiguration "Groups Without Users Should Be Removed" in AWS using Python, follow these steps:

1. Install the AWS SDK for Python (boto3) using pip:

pip install boto3

2. Create an AWS IAM client using boto3:

import boto3

iam = boto3.client('iam')

3. Use the list_groups method to get a list of all IAM groups:

response = iam.list_groups()
groups = response['Groups']

4. Use a loop to iterate over the list of groups and check if each group has any users:

for group in groups:
    group_name = group['GroupName']
    response = iam.get_group(GroupName=group_name)
    users = response['Users']
    if not users:
        iam.delete_group(GroupName=group_name)

5. Use the delete_group method to delete any groups that do not have any users.

6. Save the Python script and run it to remediate the misconfiguration.

Note: Before running the script, make sure you have the necessary permissions to delete IAM groups.

Using Terraform

# There is no aws_iam_group resource for the empty group anymore.
# Remove any aws_iam_group "EMPTY_GROUP_NAME" block from your Terraform code
# and run:
#   terraform apply
#
# Terraform will then plan to destroy the now-unmanaged IAM group in AWS.
#
# Substitute:
# - EMPTY_GROUP_NAME with the name of the empty IAM group you want removed.

This remediation cannot be represented as a modified resource block: in Terraform, deleting an IAM group is done by removing the aws_iam_group resource for that group from configuration and applying, which causes Terraform to destroy the group (equivalent to aws iam delete-group).

Verification in terraform plan: you should see a - destroy action for aws_iam_group.EMPTY_GROUP_NAME and no remaining resources referencing that group.

Additional Reading:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_add-remove-users.html