turbot/aws_compliance

Control: IAM roles should not have read only access for external AWS accounts

Description

Ensure IAM Roles do not have ReadOnlyAccess access for external AWS account. The AWS-managed ReadOnlyAccess policy carries a high risk of potential data leakage, posing a significant threat to customer security and privacy.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.iam_role_cross_account_read_only_access_policy

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.iam_role_cross_account_read_only_access_policy --share

SQL

This control uses a named query:

iam_role_cross_account_read_only_access_policy

Tags