Homepage

A support role has not been created to manage incidents with AWS Support Affecting IAM service in AWS

Severity

0.0
medium
0
10
Severity Framework
Snyk CCSS
Rule category
IAM/ Access

Is your environment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
Frameworks
CIS-AWS
  • Snyk IDSNYK-CC-00126
  • creditSnyk Research Team
Report a new misconfiguration Found a mistake?

Description

AWS provides a support center that may need access to an AWS account to help manage incidents. To implement least privilege for access control, an IAM role should be created with the managed 'AWSSupportAccess' IAM policy attached.

How to fix?

Use an aws_iam_policy_attachment or aws_iam_role_policy_attachment to attach the AWS managed policy AWSSupportAccess to an aws_iam_role by using an ARN similar to arn:aws:iam::aws:policy/AWSSupportAccess.

Example configuration:

Using an aws_iam_policy_attachment:

resource "aws_iam_role" "main" {
  name = "rm_2072"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_policy_attachment" "main" {
  name       = "main"
  roles      = [aws_iam_role.main.name]
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}

Using an aws_iam_role_policy_attachment:

resource "aws_iam_role" "main" {
  name = "rm_2072"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "main" {
  role       = "${aws_iam_role.main.name}"
  policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}