AWS securityhub medium security documentation change
Summary
Added new security control [CloudFormation.4] requiring service roles for CloudFormation stacks
Security assessment
Explicitly addresses privilege escalation risks by enforcing least-privilege access. Control note warns about permission inheritance risks and provides remediation guidance.
Diff
diff --git a/securityhub/latest/userguide/cloudformation-controls.md b/securityhub/latest/userguide/cloudformation-controls.md index a3a848062..f80bf85aa 100644 --- a//securityhub/latest/userguide/cloudformation-controls.md +++ b//securityhub/latest/userguide/cloudformation-controls.md @@ -5 +5 @@ -[CloudFormation.1] CloudFormation stacks should be integrated with Simple Notification Service (SNS)[CloudFormation.2] CloudFormation stacks should be tagged[CloudFormation.3] CloudFormation stacks should have termination protection enabled +[CloudFormation.1] CloudFormation stacks should be integrated with Simple Notification Service (SNS)[CloudFormation.2] CloudFormation stacks should be tagged[CloudFormation.3] CloudFormation stacks should have termination protection enabled[CloudFormation.4] CloudFormation stacks should have associated service roles @@ -96,0 +97,26 @@ To enable termination protection on a CloudFormation stack, see [Protect CloudFo +## [CloudFormation.4] CloudFormation stacks should have associated service roles + +**Category:** Detect > Secure access management + +**Severity:** Medium + +**Resource type:** `AWS::CloudFormation::Stack` + +**AWS Config rule:** `cloudformation-stack-service-role-check` + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether an AWS CloudFormation stack has a service role associated with it. The control fails for a CloudFormation stack if no service role is associated with it. + +Using service roles with CloudFormation stacks helps implement least privilege access by separating permissions between the user who creates/updates stacks and the permissions needed by CloudFormation to create/update resources. This reduces the risk of privilege escalation and helps maintain security boundaries between different operational roles. + +###### Note + +It is not possible to remove a service role attached to a stack after the stack is created. Other users that have permissions to perform operations on this stack are able to use this role, regardless of whether those users have the `iam:PassRole` permission or not. If the role includes permissions that the user shouldn't have, you can unintentionally escalate a user's permissions. Ensure that the role grants least privilege. + +### Remediation + +To associate a service role with a CloudFormation stack, see [CloudFormation service role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-servicerole.html) in the _AWS CloudFormation User Guide_. +