AWS controltower documentation change
Summary
Removed two preventive controls: AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS (Disallow creation of access keys for root user) and AWS-GR_RESTRICT_ROOT_USER (Disallow actions as root user) from the documentation.
Security assessment
The change removes documentation for security controls related to root user restrictions, but doesn't indicate a security vulnerability fix. It reduces security documentation coverage by eliminating preventive measures for root account protection.
Diff
diff --git a/controltower/latest/controlreference/elective-preventive-controls.md b/controltower/latest/controlreference/elective-preventive-controls.md index 6cb8567a4..74742631a 100644 --- a//controltower/latest/controlreference/elective-preventive-controls.md +++ b//controltower/latest/controlreference/elective-preventive-controls.md @@ -7 +7 @@ -AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLEDAWS-GR_AUDIT_BUCKET_LOGGING_ENABLEDAWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITEDAWS-GR_AUDIT_BUCKET_RETENTION_POLICYAWS-GR_DISALLOW_CROSS_REGION_NETWORKINGAWS-GR_DISALLOW_VPC_INTERNET_ACCESSAWS-GR_DISALLOW_VPN_CONNECTIONSAWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYSAWS-GR_RESTRICT_ROOT_USERAWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATIONAWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFACloudFormation hook SCP +AWS-GR_AUDIT_BUCKET_ENCRYPTION_ENABLEDAWS-GR_AUDIT_BUCKET_LOGGING_ENABLEDAWS-GR_AUDIT_BUCKET_POLICY_CHANGES_PROHIBITEDAWS-GR_AUDIT_BUCKET_RETENTION_POLICYAWS-GR_DISALLOW_CROSS_REGION_NETWORKINGAWS-GR_DISALLOW_VPC_INTERNET_ACCESSAWS-GR_DISALLOW_VPN_CONNECTIONSAWS-GR_RESTRICT_S3_CROSS_REGION_REPLICATIONAWS-GR_RESTRICT_S3_DELETE_WITHOUT_MFACloudFormation hook SCP @@ -31,4 +30,0 @@ The elective controls with preventive behavior are configurable. For more inform - * [AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS] Disallow creation of access keys for the root user - - * [AWS-GR_RESTRICT_ROOT_USER] Disallow actions as a root user - @@ -454,114 +449,0 @@ The artifact for this control is the following service control policy (SCP). -## [AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS] Disallow creation of access keys for the root user - -Secure your AWS accounts by disallowing creation of access keys for the root user, which will allow unrestricted access to all resources in the account. We recommend that you instead create access keys for an AWS Identity and Access Management (IAM) user for everyday interaction with your AWS account. - -This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs. - -**AWS service:** AWS Identity and Access Management (IAM) - -###### Control metadata - - * **Control objective:** Enforce least privilege - - * **Implementation:** Service control policy (SCP) - - * **Control behavior:** Preventive - - * **Control owner:** AWS Control Tower - - * **Resource types:**`AWS::::Account`, `AWS::IAM::AccessKey` - - - - -###### Usage considerations - - * This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: **ExemptedPrincipalArns**. For more information, see [Configure controls with parameters](https://docs.aws.amazon.com//controltower/latest/controlreference/control-parameter-concepts.html). - - - - -The artifact for this control is the following service control policy (SCP). - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "GRRESTRICTROOTUSERACCESSKEYS", - "Effect": "Deny", - "Action": "iam:CreateAccessKey", - "Resource": "*", - "Condition": { - "ArnLike": { - "aws:PrincipalArn": [ - "arn:*:iam::*:root" - ] - }{% if ExemptedPrincipalArns %}, - "ArnNotLike": { - "aws:PrincipalArn": {{ExemptedPrincipalArns}} - }{% endif %} - } - } - ] - } - - - -## [AWS-GR_RESTRICT_ROOT_USER] Disallow actions as a root user - -Secure your AWS accounts by disallowing account access with root user credentials, which are credentials of the account owner and allow unrestricted access to all resources in the account. We recommend that you instead create AWS Identity and Access Management (IAM) users for everyday interaction with your AWS account. - -This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs. - -**AWS service:** AWS Identity and Access Management (IAM) - -###### Control metadata - - * **Control objective:** Enforce least privilege - - * **Implementation:** Service control policy (SCP) - - * **Control behavior:** Preventive - - * **Control owner:** AWS Control Tower - - * **Resource types:**`AWS::::Account` - - - - -###### Usage considerations - - * This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: **ExemptedPrincipalArns**. For more information, see [Configure controls with parameters](https://docs.aws.amazon.com//controltower/latest/controlreference/control-parameter-concepts.html). - - - - -The artifact for this control is the following service control policy (SCP). - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "GRRESTRICTROOTUSER", - "Effect": "Deny", - "Action": "*", - "Resource": "*", - "Condition": { - "StringLike": { - "aws:PrincipalArn": [ - "arn:*:iam::*:root" - ] - }{% if ExemptedPrincipalArns %}, - "ArnNotLike": { - "aws:PrincipalArn": {{ExemptedPrincipalArns}} - }{% endif %} - } - } - ] - } - - -