4

An administrator of an AWS account wants their users to be able to create their own S3 buckets, SQS queues, and KMS keys and attach resource-based IAM policies to their resources. How can said administrator find resources that have resource-based IAM policies in bulk and review these to ensure they are in compliance with a set of standards?

Given that these policies are in line, the only thing I can think of is to use Amazon's list of aws services that support resource based policies, find all resources of each of these services, and then get the policy associated with each of the resources.

This approach does not allow effective planning for the potential of AWS enabling users to attach resource-based policies to future Amazon services.

Is there a best practice or a smarter approach here?

0

You should be able to use AWS Config for this to ensure that only certain policies are allowed. Within Storage, you have the following options:

ebs-snapshot-public-restorable-check
efs-encrypted-check
elb-deletion-protection-enabled
s3-bucket-blacklisted-actions-prohibited
s3-bucket-logging-enabled
s3-bucket-policy-grantee-check
s3-bucket-policy-not-more-permissive
s3-bucket-public-read-prohibited
s3-bucket-public-write-prohibited
s3-bucket-replication-enabled
s3-bucket-server-side-encryption-enabled
s3-bucket-ssl-requests-only
s3-bucket-versioning-enabled

For your usage case, I think you can use s3-bucket-blacklisted-actions-prohibited and block for example all s3:GetBucket* policies.

You can also use these rules in CloudFormation templates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.