IAM Entry Analyzer Replace: Extending customized coverage checks & guided revocation

By enhancing our capabilities, we’re now able to provide more precise, tailored risk assessments, accompanied by seamless access to intuitive control mechanisms that empower you to refine your individualized asset management (IAM) insurance coverage with greater ease. The innovative solutions presented at re:Invent 2023 form the foundation for these cutting-edge options. Right here’s what we’re launching:

With the power of automated reasoning harnessed, the latest checks enable seamless detection of insurance policies allowing access to critical AWS assets or granting public access, thereby ensuring robust security posture. Each check is designed for use prior to deployment, likely integrated into your continuous integration and continuous delivery pipeline, enabling proactive detection of updates that fail to comply with your team’s safety protocols and insurance requirements.

– With the enhanced IAM Entry Analyzer, you can receive actionable insights to share with your developers, empowering them to promptly revoke unnecessary access and prevent unwanted entries. This comprises unused roles, roles boasting unutilized permissions, dormant entry keys for IAM customers, and dormant passwords for IAM customers. The instructions specify the procedures necessary to either remove supplementary items or replace them with more stringent alternatives.

The brand-new coverage checks can be invoked either from the command line or through a call to an API operation. The checks study a comprehensive documentation package that’s provided as an integral component of the request, returning a PASS or FAIL worth. In each instances, PASS The system flags the entry as invalid due to correct coverage documentation. FAIL The provision of this signature signifies that the coverage may enable some or all of the necessary permissions.

Introducing our brand-new checks.

This verification operates on a resource coverage, checking whether such coverage permits public access to a specific resource type. You can verify a policy to see if it allows public access to an S3 bucket by specifying the BucketPolicy. AWS::S3::Bucket useful resource sort. Legitimate useful resource sorts include DynamoDB tables and streams, EFS file systems, OpenSearch domains, Kinesis streams and stream consumers, KMS keys, Lambda functions, S3 buckets and entry points, S3 specific listing buckets, S3 Outposts buckets and entry points, Amazon Glacier, Secrets Manager secrets, SNS topics and queues, and IAM policy documents that assume roles. The documentation will contain a comprehensive catalog of legitimate useful resource types that will continue to evolve and expand over time.

The carelessness of granting public entry to a queue inadvertently is understood. Here’s how I verify it:

aws accessanalyzer check-no-public-access --policy-document file:///path/to/useful-resource.json --resource-type AWS::SQS::Queue --output json

What a fantastic achievement!

{
"outcome": "FAIL",
"message": "The public entry grant for the designated resource type is not permitted.",
"causes": [
{
"description": "Public accessibility has been explicitly denied in the SqsResourcePolicy statement with sid 0.",
"statementIndex": 0,
"statementId": "SqsResourcePolicy"
}
]
}

I reworked the edit to remove the entry grant and checked again; this time, the verification succeeded seamlessly.

{ "outcome": "FAIL", "message": "No publicly accessible resources found." }

The verification process focuses on a solitary asset identifier or scope at a given moment in time. This also accommodates a log of actions and assets, formatted in a way that is compatible with IAM policy specifications. The verification process checks whether the coverage inadvertently permits access to any assets within the record through the specified actions. To prevent accidental deletion of a vital CloudTrail path, one may employ a verification mechanism like this.

`aws accessanalyzer check-access-not-granted --policy-document file://ct.json --access assets=arn:aws:cloudtrail:us-east-1:123456789012:path/MySensitiveTrail --policy-type identity-policy --output=json`

The IAM Entry Analyzer indicates a failure to verify:

{
    "outcome": "The coverage documentation grants entry to perform a selection of the enumerated actions or assets, precluding further execution.", 
    "message": "The documented permissions enable access to execute multiple listed actions or resources.",
    "causes": [
        {
            "description": "One or more of the stated actions or resources at index 0 fail to meet the necessary conditions.",
            "statementIndex": 0
        }
    ]
}

Upon re-examining the coverage and conducting a subsequent verification, I discovered that the test ultimately succeeds, confirming that the coverage effectively denies access to the designated resources.

{
    "outcome": "FAIL",
    "message": "Access denied due to insufficient documentation; coverage limitations prevent execution of specified actions and asset utilization." }

I previously demonstrated how IAM Entry Analyzer identifies and lists IAM objects that inadvertently grant unwanted access, enabling more effective security posture management. Upon today’s release, you gain access to intuitive steering tools that empower both individual developers and development teams to address identified issues with ease. The latest insights from your Amazon Web Services account reveal:

These instances include ones I was granted early access to for the purpose of reviewing and subsequently blogging about them, while others stem from my innate clumsiness as a cloud administrator. Let’s have them washed up nicely? What do you want me to improve about the second one? Please provide the text and I’ll get back to you with an edited version. When I click on the merchandise, I may also discover a brand-new part on the backside.

You can either observe the steps and delete the entry key, or you can click on “Archive” to remove the finding from the list of active discoveries and transfer it to the archives. You can also establish an archival rule that will achieve the same outcome for related discoveries at a later time. Suggestions for comparable alternatives are provided for unused IAM customers, IAM roles, and passwords.

Now let’s explore the discovery of…

It is recommended that existing coverage is replaced by fresh and innovative alternatives. You can preview the newly designed coverage alongside the current version:

I can execute the observations or document my findings.

The findings and suggestions are accessible directly from the command line. You generate advice by specifying an analyst and deriving insights from their expertise.

$ aws accessanalyzer generate-finding-recommendation 
  --analyzer-arn arn:aws:access-analyzer-beta:us-west-2:123456789012:analyzer/MyAnalyzer 
  --id 67110f3e-05a1-4562-b6c2-4b009e67c38e

Then I retrieve the advice. I’m filtering the output to solely present the steps as the comprehensive JSON output is quite extensive.

CREATE_POLICY or DETACH_POLICY?

To successfully integrate the suggested approaches with your existing tools and methods, you must first acquaint yourself with the specific APIs or instruction sets that govern their utilization.

The newly released checks and decision-making steps are now available for immediate use across all public AWS regions.

— ;