Ensure AWS resource policies do not allow unrestricted access using "Principal": "*"

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

1. Identify resources that support resource-based policies within the AWS account, such as S3 buckets, SQS queues, SNS topics, and Lambda functions 2. Retrieve the resource policies for each resource. Example CLI commands: SQS Queue Policies aws sqs get-queue-attributes \ --queue-url https://sqs.region.amazonaws.com/account/QUEUE \ --attribute-names Policy S3 Bucket Policies aws s3api get-bucket-policy \ --bucket YOUR-BUCKET-NAME SNS Topic Policies aws sns get-topic-attributes \ --topic-arn TOPIC-ARN \ --query "Attributes.Policy" \ --output text 3. Inspect the retrieved policies and identify statements containing: - "Effect": "Allow" AND "Principal": "*" OR - "Principal": {"AWS": "*"} 4. Evaluate whether the statement includes restrictive conditions such as: - aws:SourceArn - aws:SourceAccount - aws:PrincipalArn - Other service-specific condition keys 5. Determine audit status: - Compliant: Wildcard principals are present only when restrictive conditions limit access to trusted principals or services - Non-Compliant: Wildcard principals are used without sufficient restrictions

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

If a resource policy contains "Principal": "*" with "Effect": "Allow" and lacks sufficient restrictions, modify the policy to limit access. OPTION 1 – Restrict the Principal Replace the wildcard principal ("Principal": "*") with a specific account, role, user, or service. Example: Non-Compliant Policy { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowPublicAccess", "Effect": "Allow", "Principal": "*", "Action": "sqs:SendMessage", "Resource": "arn:aws:sqs:us-east-1:123456789012:my-queue" } ] } Steps: 1. Retrieve the current policy: aws sqs get-queue-attributes \ --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue \ --attribute-names Policy \ --query 'Attributes.Policy' 2. Update the policy with a specific principal: aws sqs set-queue-attributes \ --queue-url https://sqs.us-east-1.amazonaws.com/123456789012/my-queue \ --attributes '{ "Policy": "{\"Version\":\"2012-10- 17\",\"Statement\":[{\"Sid\":\"AllowSpecificAccount\",\"Effect\":\"Allow\",\" Principal\":{\"AWS\":\"arn:aws:iam::345678901234:root\"},\"Action\":\"sqs:Sen dMessage\",\"Resource\":\"arn:aws:sqs:us-east-1:123456789012:my-queue\"}]}" }' Resulting Compliant Policy: { "Version": "2012-10-17", "St...