Homepage
About Snyk

A support role has not been created to manage incidents with AWS Support Affecting IAM service in AWS

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category IAM / Access

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-AWS
  • Snyk ID SNYK-CC-00126
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

AWS provides a support center that may need access to an AWS account to help manage incidents. To implement least privilege for access control, an IAM role should be created with the managed 'AWSSupportAccess' IAM policy attached.

How to fix?

Use an aws_iam_policy_attachment or aws_iam_role_policy_attachment to attach the AWS managed policy AWSSupportAccess to an aws_iam_role by using an ARN similar to arn:aws:iam::aws:policy/AWSSupportAccess.

Example Configuration

Using an aws_iam_policy_attachment:

resource "aws_iam_role" "main" {
  name = "rm_2072"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_policy_attachment" "main" {
  name       = "main"
  roles      = [aws_iam_role.main.name]
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}

Using an aws_iam_role_policy_attachment:

resource "aws_iam_role" "main" {
  name = "rm_2072"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "main" {
  role       = "${aws_iam_role.main.name}"
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}