All checks
Low
Ensure a support role has been created to manage incidents with AWS Support
Checks that the AWSSupportAccess managed policy is attached to at least one IAM role, user or group, so authorized people can manage incidents with AWS Support. The attachment is what counts, not a name: a role called support without the policy does not pass, and a group carrying it counts only while it has at least one member.
- service
- IAM
- severity
- Low
- scope
- evaluated once per account
How to fix it
In the console
IAM → Roles → the incident response role → Permissions policies
- Attach policies
- AWSSupportAccess (AWS managed policy)
With the AWS CLI
aws iam attach-role-policy --role-name <role-name> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccessWith Terraform
resource "aws_iam_role_policy_attachment" "this" {
role = var.role_name
policy_arn = "arn:aws:iam::aws:policy/AWSSupportAccess"
}See which of your accounts this check is failing on.
Book a live scan