Medium
IAM
IAM identities should not have the AWSCloudShellFullAccess policy attached
CIS v5.0.0ISO 27001
Description
Flags IAM identities (users, roles, or groups) that have the AWSCloudShellFullAccess managed policy attached.
Remediation
To remediate IAM identities with AWSCloudShellFullAccess policy, you need to remove this policy from all IAM identities.
Steps
- Navigate to the AWS IAM console
- Go to 'Users', 'Roles', or 'Groups' in the left navigation
- Review each IAM identity's attached policies
- Identify identities with AWSCloudShellFullAccess policy
- Remove the AWSCloudShellFullAccess policy from these identities
- Replace with more restrictive policies if CloudShell access is needed
- Consider using least privilege principles for CloudShell access
- Document policy changes for audit purposes
- Review and update IAM policies regularly
- Implement policy monitoring to prevent future violations
Compliance
CIS v5.0.0ISO 27001