The AWS Managed IAMFullAccess IAM policy should not be used misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC2_AWS_56
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	HIGH
Framework	Terraform, Terraform Plan

Impact

This rule detects situations where the AWS Managed IAMFullAccess IAM policy is being used. The IAMFullAccess policy grants full permissions to manage all aspects of IAM, which can be a security threat if not managed correctly.

How to Fix

Terraform

• Resource: aws_iam_role_policy_attachment
• Arguments: policy_arn

To fix, it's recommended to replace IAMFullAccess with more granular, least privilege policies that limit scope of permissions. Remove policy_arn = "arn:aws:iam::aws:policy/IAMFullAccess" and replace it with the ARN of the least privilege policy.

Secure code example:

In this fixed example, we attach a policy with least-privilege to the IAM role, effectively reducing the potential security risk associated with the FULLACCESS permissions. [source,go]

resource "aws_iam_role_policy_attachment" "example" { role = "example" policy_arn = "arn:aws:iam::aws:policy/AnotherIAMPolicyWithLeastPrivilege" }