AWS SageMaker notebook instance IAM policy is overly permissive misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_68
Category - Subcategory	IAM - Permissions
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

This rule checks whether IAM policies for SageMaker Notebook Instances are overly permissive. Overly permissive IAM policies can grant unauthorized access, potentially leading to data breaches or loss. This includes unauthorized users modifying configurations or deleting resources. This rule enforces least privilege, ensuring users only have necessary permissions for their tasks, strengthening your security posture.

How to Fix

Resource:* AWS::SageMaker::NotebookInstance, AWS::IAM::Role

• Arguments: AssumeRolePolicyDocument

Ensure the IAM role attached to the SageMaker notebook does not have an Allow statement with Action = "*" in your CloudFormation template. [source,go]

Resources: Example: Type: AWS::SageMaker::NotebookInstance Properties: ... RoleArn: !GetAtt ExampleRole.Arn

ExampleRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement:

• Effect: Allow Principal: Service: sagemaker.amazonaws.com
• Action: *
• Action: sts:AssumeRole

---