AWS IAM Policy Does Not Grant Any Administrative Access

Description

This policy validates that no IAM policies grant admin access. This should be combined with suppressions on the legitimate IAM admin policies in your account so that it only fires when new and unexpected policies granting admin access are created.

Query · python

import json

from policyuniverse.expander_minimizer import expand_policy
from policyuniverse.policy import Policy

# White listed policies (e.g. the approved admin policies) can be specified here, or as an
# exception to this policy.

ADMIN_ACTIONS = {
    "Permissions",
}


def policy(resource):
    iam_policy = Policy(expand_policy(json.loads(resource["PolicyDocument"])))
    action_summary = iam_policy.action_summary()

    # Sometimes AWS Service Linked Roles+Policies violate the
    # expectation as expressed in policyuniverse.
    # service-linked roles have a path of /aws-service-role/
    #   service-linked roles and their policies are not editable
    # service-role is editable, and so not included
    if resource.get("Path", "") == "/aws-service-role/":
        return True

    # Check if the policy grants any administrative privileges
    return not any(
        ADMIN_ACTIONS.intersection(action_summary[service]) for service in action_summary
    )

Analyst notes

Delete the unapproved IAM admin policy.

Detection tier

Not a detection

This rule makes no claim about adversary activity — it asserts configuration, suppresses an alert, or records a policy violation — so it sits at no rung of the pyramid.

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: —
Modified: 2024-04-02
Authored by: panther-labs
Source ID: —
Upstream: policies/aws_iam_policies/aws_iam_policy_does_not_grant_admin_access.yml
Type: policy
Version: 1
References: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

ATT&CK

TA0004 T1078