Control: 2.16 Ensure a support role has been created to manage incidents with AWS Support
Description
AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services. Create an IAM Role, with the appropriate policy assigned, to allow authorized users to manage incidents with AWS Support.
Remediation
From Console:
- From
All Services
, clickIAM
. - Under
Access Managemen
t, clickPolicies
. - In the
Policies search field
, search for 'AWSSupportAccess'. - Click the policy name 'AWSSupportAccess'.
- Click the
Entities Attached
menu and clickAttach
. - Add the appropriate role or roles and click
Attach policy
.
From Command Line:
- Create an IAM role for managing incidents with AWS:
- Create a trust relationship policy document that allows <iam_user> to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "<iam_user>" }, "Action": "sts:AssumeRole" ]}
- Create the IAM role using the above trust policy:
- aws iam create-role --role-name <aws_support_iam_role> --assume-rolepolicy-document file:///tmp/TrustPolicy.json
- Attach 'AWSSupportAccess' managed policy to the created IAM role:
- aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name <aws_support_iam_role>
Default Value:
By default, AWS does not create a dedicated support role. IAM users and roles with sufficient privileges (such as AdministratorAccess) can access the Support Center unless a specific role with the AWSSupportAccess policy is created.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cis_v600_2_16
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cis_v600_2_16 --share
SQL
This control uses a named query:
-- pgFormatter-ignorewith support_role_count as( select 'arn:' || a.partition || ':::' || a.account_id as resource, count(policy_arn), a.account_id, a._ctx from aws_account as a left join aws_iam_role as r on r.account_id = a.account_id left join jsonb_array_elements_text(attached_policy_arns) as policy_arn on true where split_part(policy_arn, '/', 2) = 'AWSSupportAccess' or policy_arn is null group by a.account_id, a.partition, a._ctx)select resource, case when count > 0 then 'ok' else 'alarm' end as status, case when count = 1 then 'AWSSupportAccess policy attached to 1 role.' when count > 1 then 'AWSSupportAccess policy attached to ' || count || ' roles.' else 'AWSSupportAccess policy not attached to any role.' end as reason , account_idfrom support_role_count;