Control: 2.17 Ensure IAM instance roles are used for AWS resource access from instances

Description

AWS access from within AWS instances can be done by either encoding AWS keys into AWS API calls or by assigning the instance to a role which has an appropriate permissions policy for the required access. "AWS Access" means accessing the APIs of AWS in order to access AWS resources or manage AWS account resources.

Remediation

From Console:

Sign in to the AWS Management Console and navigate to the EC2 dashboard at https://console.aws.amazon.com/ec2/.
In the left navigation panel, choose Instances.
Select the EC2 instance you want to modify.
Click Actions.
Click Security.
Click Modify IAM role.
Click Create new IAM role if a new IAM role is required.
Select the IAM role you want to attach to your instance in the IAM role dropdown.
Click Update IAM role.
Repeat steps 3 to 9 for each EC2 instance in your AWS account that requires an IAM role to be attached.

From Command Line:

Run the describe-instances command to list all EC2 instance IDs in the selected AWS region:

aws ec2 describe-instances --region <region-name> --query 'Reservations[*].Instances[*].InstanceId'

Run the associate-iam-instance-profile command to attach an instance profile (which is attached to an IAM role) to the EC2 instance:

aws ec2 associate-iam-instance-profile --region <region-name> --instance-id <Instance-ID> --iam-instance-profile Name="Instance-Profile-Name"

Run the describe-instances command again for the recently modified EC2 instance. The command output should return the instance profile ARN and ID:

aws ec2 describe-instances --region <region-name> --instance-id <Instance-ID> --query 'Reservations[*].Instances[*].IamInstanceProfile'

Repeat steps 2 and 3 for each EC2 instance in your AWS account that requires an IAM role to be attached.

Default Value:

By default, EC2 instances are launched without an IAM role attached. Applications running on the instance must use embedded credentials or manually assigned access keys unless an instance role is explicitly configured.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v600_2_17

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v600_2_17 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when iam_instance_profile_arn is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when iam_instance_profile_arn is not null then title || ' uses IAM role for access.'
    else title || ' does not use IAM role for access.'
  end as reason
  
  , region, account_id
from
  aws_ec2_instance;