Unapproved IAM Policy in Use

Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access Unapproved IAM Policy in Use rule settings and copy the name of the unapproved IAM managed policy that you want to examine.

Sign in to AWS Management Console.

Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

In the left navigation panel, select Policies to access the list of the IAM managed policies available in your AWS account.

Paste the name of the unapproved policy, copied at step no. 1, in the Search box and press Enter.

Click on the name (link) of the IAM managed policy returned as search result.

Select the Policy usage tab and check the Permissions section for the list of IAM identities (roles, users, and groups) associated with the selected policy. If the selected Amazon IAM managed policy is attached to one or more IAM identities, the unapproved policy is used within your AWS cloud account, therefore you must take action and decommission (detach) the selected IAM policy.

Repeat steps no. 1 – 7 to determine the usage status for other unapproved Amazon IAM managed policies.

Sign into your TrendAI Vision One™ account to access Cloud Risk Management, access Unapproved IAM Policy in Use rule settings and copy the Amazon Resource Name (ARN) of the unapproved IAM managed policy that you want to examine.

Run get-policy command (OSX/Linux/UNIX) using the ARN of the unapproved IAM policy that you want to examine as identifier parameter and custom query filters to describe the number of IAM entities (users, groups, and roles) that the selected policy is attached to:

aws iam get-policy
	--policy-arn arn:aws:iam::aws:policy/AmazonRDSFullAccess
	--query 'Policy.{"AttachmentCount": AttachmentCount}'

The command output should return the attachment count for the specified identity-based policy:

{
    "AttachmentCount": 3
}

If the "AttachmentCount" configuration attribute value is different than 0 (zero), as shown in the example above, the selected Amazon IAM managed policy is attached to one or more IAM identities, therefore the unapproved IAM policy is used within your AWS cloud account.

Repeat steps no. 1 – 3 to determine the usage status for other unapproved Amazon IAM managed policies.

Sign in to AWS Management Console.

Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

In the left navigation panel, select Policies to access the list of the IAM managed policies available in your AWS account.

Paste the name of the unapproved policy that you want to decommission in the Search box and press Enter.

Click on the name (link) of the unapproved IAM policy returned as search result.

Choose the Policy usage tab and perform the following actions:

1. Select all IAM identities (roles, users, and groups) associated with the IAM managed policy and choose Detach.
2. Inside the Detach Policy confirmation box, choose Detach.

Repeat steps no. 4 – 6 to deactivate (detach) other unapproved Amazon IAM managed policies used within your AWS account.

Run list-entities-for-policy command (OSX/Linux/UNIX) using the ARN of the unapproved IAM policy that you want to decommission as identifier parameter and custom query filters to list the names of the IAM identities (roles, users, and groups) that the specified managed policy is attached to:

aws iam list-entities-for-policy
	--policy-arn arn:aws:iam::aws:policy/AmazonRDSFullAccess
	--query '{"PolicyGroups": PolicyGroups[*].GroupName, "PolicyUsers": PolicyUsers[*].UserName, "PolicyRoles": PolicyRoles[*].RoleName}'

The command output should return the names of the IAM identities associated with the selected policy:

{
    "PolicyGroups": [
        "cc-project5-iam-group"
    ],
    "PolicyUsers": [
        "cc-project5-db-user"
    ],
    "PolicyRoles": [
        "cc-rds-developer-role"
    ]
}

Depending on the type of the IAM identity (role, user, or group) associated with your unapproved managed policy, execute one of the following commands:

1. If the policy is attached to an IAM group, run detach-group-policy command (OSX/Linux/UNIX) to detach the selected managed policy from the specified IAM group. The following command example removes a managed, unapproved policy, identified by the ARN "arn:aws:iam::aws:policy/AmazonRDSFullAccess", from an IAM group named "cc-project5-iam-group" (the command does not produce an output):
   	aws iam detach-group-policy
   		--group-name cc-project5-iam-group
   		--policy-arn arn:aws:iam::aws:policy/AmazonRDSFullAccess
   	

2. If the policy is attached to an IAM user, run detach-user-policy command (OSX/Linux/UNIX) to detach the selected managed policy from the specified IAM user (the command does not return an output):
   	aws iam detach-user-policy
   		--user-name cc-project5-db-user
   		--policy-arn arn:aws:iam::aws:policy/AmazonRDSFullAccess
   	

3. If the policy is attached to an IAM role, run detach-role-policy command (OSX/Linux/UNIX) to detach the selected managed policy from the specified IAM role (the command does not produce an output):
   	aws aws iam detach-role-policy
   		--role-name cc-rds-developer-role
   		--policy-arn arn:aws:iam::aws:policy/AmazonRDSFullAccess
   	

Repeat steps no. 1 – 3 to deactivate (detach) other unapproved Amazon IAM managed policies used within your AWS cloud account.