Publicly assumable IAM role can access sensitive data

iam
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Description

A publicly assumable IAM role has direct access to sensitive data. This configuration allows any AWS principal, including those from external AWS accounts, to assume the role and directly access sensitive resources such as S3 buckets, RDS databases, or DynamoDB tables. An attacker with any valid AWS credentials can exploit this misconfigured trust policy to gain unauthorized access to protected data.

Remediation

  1. Review and manage IAM roles to restrict the trust policy and limit which principals can assume the role.
  2. Apply IAM security best practices to remove unnecessary access to sensitive data.