Project: KICS (Provisioning / Security & Compliance)
File: d71b5fd7-9020-4b2d-9ec8-b3839faa2744.md

title: Support Has No Role Associated hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: d71b5fd7-9020-4b2d-9ec8-b3839faa2744 Query name: Support Has No Role Associated Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Access Control URL: Check if any AWS Support policy does not have any role and users and group associated, which means that is not being managed.<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="16 4 28" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: noRoles: Type: AWS::IAM::Policy Properties: PolicyName: AWSSupportAccess PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: ["*"] Resource: "*" Users: ["SomeUser"] Groups: ["SomeGroup"] noUsers: Type: AWS::IAM::Policy Properties: PolicyName: AWSSupportAccess PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: ["*"] Resource: "*" Roles: ["SomeRole"] Groups: ["SomeGroup"] noGroups: Type: AWS::IAM::Policy Properties: PolicyName: AWSSupportAccess PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: ["*"] Resource: "*" Roles: ["SomeRole"] Users: ["SomeUser"] ``` ```json title="Positive test num. 2 - json file" hl_lines="29 53 5" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "noRoles": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "AWSSupportAccess", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "*" ], "Resource": "*" } ] }, "Users": [ "SomeUser" ], "Groups": [ "SomeGroup" ] } }, "noUsers": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "AWSSupportAccess", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "*" ], "Resource": "*" } ] }, "Roles": [ "SomeRole" ], "Groups": [ "SomeGroup" ] } }, "noGroups": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "AWSSupportAccess", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "*" ], "Resource": "*" } ] }, "Roles": [ "SomeRole" ], "Users": [ "SomeUser" ] } } } } ``` ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: MyPolicy: Type: AWS::IAM::Policy Properties: PolicyName: mygrouppolicy PolicyDocument: Version: "2012-10-17" Statement: Effect: Allow Action: s3:GetObject s3:PutObject s3:PutObjectAcl Resource: arn:aws:s3:::myAWSBucket/* Groups: myexistinggroup1 !Ref mygroup ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "MyPolicy": { "Type": "AWS::IAM::Policy", "Properties": { "PolicyName": "mygrouppolicy", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:GetObject", "s3:PutObject", "s3:PutObjectAcl" ], "Resource": "arn:aws:s3:::myAWSBucket/*", "Effect": "Allow" } ] }, "Groups": [ "myexistinggroup1", "mygroup" ] } } } } ```