Introduction

This hands-on exercise shows how to find non-compliant resources in AWS Config and how to whitelist them for Config.

Part 1 – Remove Outside Access to a Resource

Goal

In this exercise, you will use Access Analyzer to find an IAM Role role that allows access from an outside AWS account and remove that access.

We have prepared this AWS accounts with roles named example-role-NETID for each of the training participants.

Part 1A – Login an get to Access Analyzer

  1. Login to the cu-training AWS account using traditional Shibboleth login.
    1. Use this link to initiate login: https://signin.aws.cucloud.net/
    2. If you are given the option of selecting a role, select shib-training under the "cu-training" AWS account, and click on Sign in.
  2. Once in the AWS Management Console, type "iam" in the search box and click on IAM under Services.
  3. Click on Access analyzer from the left navigation section.
  4. Check which AWS region your console is pointed at. You want "N. Virginia". If your console is in any other region, change it to "US East (N. Virigina) us-east-1".

Part 1B – Examine the Finding for "your" role

  1. Under Active findings, use the menu integrated into the filter for Resource: example-role-NETID
    1. Be sure to use the pull-down menu in the search field to select Resource
    2. Enter example-role-NETID, replacing NETID with your own Cornell NetId (e.g., example-role-pea1)
    3. Hit "enter" on your keyboard to trigger the actual search.
  2. Your search should result in one Finding that matches. Click on the Finding ID for that record to drill into the finding.
  3. Note the finding details:

In real life situations,  note that the bad-actor Role didn't have anything to do with our creation of the example-role-NETID Role in our account and trusting the bad-actor Role. Someone (or something) with appropriate IAM privileges to our account is the only way that example-role-NETID was created or configured.



Part 1C – Remove access by the bad-actor Role

In this exercise scenario, we named the outside role bad-actor. In real life, roles are not usually so conveniently named.

Also, note that just because a Role within your AWS account trusts IAM Roles or Users from another account, it doesn't mean that access is inappropriate or unnecessary. Cross-account access is perfectly fine and often necessary. For example, that is how CloudCheckr accesses our Cornell AWS accounts to do the information gathering it does to provide its services to Cornell.

For the purposes of this exercise, we'll claim that bad-actor no longer has need for the cross-account access defined in example-role-NETID. To remove that access, we have two options:

  1. Delete the entire example-role-NETID Role. 
  2. Change the trust policy for example-role-NETID so that is no longer allows the bad-actor Role to assume it.

The appropriate course of action depends on the situation. For the purposes of this example, we'll just delete the example-role-NETID Role since, in our scenario, none of our own tools or access uses example-role-NETID.

  1. Back on the (error) (error) 

Part 2 – Archive a Finding

Goal

In this exercise, you will use Access Analyzer to archive a finding allowing public access to an S3 bucket. This indicates one-time review and approval for that access.

Part 2A