IAM Access Analyzer not enabled

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: cloudformation-aws-iam-access-analyzer-not-enabled

Provider: AWS

Platform: CloudFormation

Severity: Low

Category: Best Practices

Learn More

Description

IAM Access Analyzer provides continuous monitoring of resource-based policies to detect unintended public or cross-account access. If an AWS::AccessAnalyzer::Analyzer is not defined, these permission issues can go undetected, increasing the risk of data exposure or privilege escalation.

The CloudFormation template must include an AWS::AccessAnalyzer::Analyzer resource. Templates missing this resource will be flagged. Set the Properties.Type to ACCOUNT to monitor a single account or ORGANIZATION to monitor an AWS Organization, and optionally provide an AnalyzerName for identification.

Secure configuration example:

MyAccessAnalyzer:
  Type: AWS::AccessAnalyzer::Analyzer
  Properties:
    AnalyzerName: my-access-analyzer
    Type: ACCOUNT

Compliant Code Examples

AWSTemplateFormatVersion: 2010-09-09
Resources:
  Analyzer:
    Type: "AWS::AccessAnalyzer::Analyzer"
    Properties:
      AnalyzerName: MyAccountAnalyzer
      Type: ACCOUNT
      Tags:
        - Key: Kind
          Value: Dev
      ArchiveRules:
        - # Archive findings for a trusted AWS account
          RuleName: ArchiveTrustedAccountAccess
          Filter:
            - Property: "principal.AWS"
              Eq:
                - "123456789012"
        - # Archive findings for known public S3 buckets
          RuleName: ArchivePublicS3BucketsAccess
          Filter:
            - Property: "resource"
              Contains:
                - "arn:aws:s3:::docs-bucket"
                - "arn:aws:s3:::clients-bucket"

Non-Compliant Code Examples

AWSTemplateFormatVersion: "2010-09-09"
Description: A sample template 2
Resources:
  myuseeer:
    Type: AWS::IAM::Group
    Properties:
      Path: "/"
      LoginProfile:
        Password: myP@ssW0rd