Control: 1.20 Ensure a support role has been created to manage incidents with AWS Support
Description
AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role to allow authorized users to manage incidents with AWS Support.
By implementing least privilege for access control, an IAM Role will require an appropriate IAM Policy to allow Support Center Access in order to manage Incidents with AWS Support.
Remediation
Using the Amazon unified command line interface:
Create an IAM role for managing incidents with AWS:
- Create a trust relationship policy document that allows <iam_user> to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json:
{"Version": "2012-10-17","Statement": [{"Effect": "Allow","Principal": {"AWS": "<span style="font-style: italic;"><iam_user></span>"},"Action": "sts:AssumeRole"}]}- Create the IAM role using the above trust policy:
aws iam create-role --role-name <aws_support_iam_role> --assume-role- policy-document file:///tmp/TrustPolicy.json- Attach 'AWSSupportAccess' managed policy to the created IAM role:
aws iam attach-role-policy --policy-arn <iam_policy_arn> --role-name <aws_support_iam_role>
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v120_1_20Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v120_1_20 --shareSQL
This control uses a named query:
-- pgFormatter-ignorewith support_role_count as( select 'arn:' || a.partition || ':::' || a.account_id as resource, count(policy_arn), a.account_id, a._ctx from aws_account as a left join aws_iam_role as r on r.account_id = a.account_id left join jsonb_array_elements_text(attached_policy_arns) as policy_arn on true where split_part(policy_arn, '/', 2) = 'AWSSupportAccess' or policy_arn is null group by a.account_id, a.partition, a._ctx)select resource, case when count > 0 then 'ok' else 'alarm' end as status, case when count = 1 then 'AWSSupportAccess policy attached to 1 role.' when count > 1 then 'AWSSupportAccess policy attached to ' || count || ' roles.' else 'AWSSupportAccess policy not attached to any role.' end as reason , account_idfrom support_role_count;