Medium
IAM
IAM identities should not have AWSCloudShellFullAccess policy
CIS v5.0.0ISO 27001
Description
This control checks if an IAM identity (user, role, or group) has the AWS managed policy AWSCloudShellFullAccess attached. The control fails if an IAM identity has this policy attached. AWS CloudShell allows running CLI commands against AWS services. This policy grants full access to CloudShell, including file upload/download between a user's local system and the CloudShell environment. Users within CloudShell have sudo permissions and internet access. Attaching this policy enables them to install file transfer software and move data to external internet servers.
Remediation
To remediate IAM identities with AWSCloudShellFullAccess policy, you need to remove this policy from all IAM identities.
Steps
- Navigate to the AWS IAM console
- Go to 'Users', 'Roles', or 'Groups' in the left navigation
- Review each IAM identity's attached policies
- Identify identities with AWSCloudShellFullAccess policy
- Remove the AWSCloudShellFullAccess policy from these identities
- Replace with more restrictive policies if CloudShell access is needed
- Consider using least privilege principles for CloudShell access
- Document policy changes for audit purposes
- Review and update IAM policies regularly
- Implement policy monitoring to prevent future violations
Compliance
CIS v5.0.0ISO 27001