AWS controltower high security documentation change
Summary
Updated root user access controls with new control IDs, added metadata sections, usage considerations, and modified SCP policies with configurable exemptions
Security assessment
The changes explicitly restrict root user access keys and actions which prevent unrestricted account access. The added SCP condition 'arn:*:iam::*:root' broadens protection across partitions, and conditional exemptions (ExemptedPrincipalArns/ExemptAssumeRoot) enhance security configurability. This directly addresses privilege escalation risks by enforcing least privilege for root credentials.
Diff
diff --git a/controltower/latest/controlreference/strongly-recommended-preventive-controls.md b/controltower/latest/controlreference/strongly-recommended-preventive-controls.md index 99b3601ef..87167a3ec 100644 --- a//controltower/latest/controlreference/strongly-recommended-preventive-controls.md +++ b//controltower/latest/controlreference/strongly-recommended-preventive-controls.md @@ -7 +7 @@ -Disallow Creation of Access Keys for the Root UserDisallow Actions as a Root User +AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYSAWS-GR_RESTRICT_ROOT_USER @@ -15 +15 @@ The following strongly recommended controls have preventive behavior. - * Disallow Creation of Access Keys for the Root User + * [AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS] Disallow creation of access keys for the root user @@ -17 +17 @@ The following strongly recommended controls have preventive behavior. - * Disallow Actions as a Root User + * [AWS-GR_RESTRICT_ROOT_USER] Disallow actions as a root user @@ -22 +22 @@ The following strongly recommended controls have preventive behavior. -## Disallow Creation of Access Keys for the Root User +## [AWS-GR_RESTRICT_ROOT_USER_ACCESS_KEYS] Disallow creation of access keys for the root user @@ -24 +24 @@ The following strongly recommended controls have preventive behavior. -Secures your AWS accounts by disallowing creation of access keys for the root user. We recommend that you instead create access keys for the IAM users or IAM Identity Center users, which grant limited permissions to interact with your AWS account. This is a preventive control with strongly recommended guidance. By default, this control is not enabled. +Secure your AWS accounts by disallowing creation of access keys for the root user, which will allow unrestricted access to all resources in the account. We recommend that you instead create access keys for an AWS Identity and Access Management (IAM) user for everyday interaction with your AWS account. @@ -26 +26 @@ Secures your AWS accounts by disallowing creation of access keys for the root us -The artifact for this control is the following SCP. +This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs. @@ -28 +28 @@ The artifact for this control is the following SCP. -JSON +**AWS service:** AWS Identity and Access Management (IAM) @@ -29,0 +30 @@ JSON +###### Control metadata @@ -31 +32 @@ JSON -**** + * **Control objective:** Enforce least privilege @@ -32,0 +34,19 @@ JSON + * **Implementation:** Service control policy (SCP) + + * **Control behavior:** Preventive + + * **Control owner:** AWS Control Tower + + * **Resource types:**`AWS::::Account`, `AWS::IAM::AccessKey` + + + + +###### Usage considerations + + * This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: **ExemptedPrincipalArns**. For more information, see [Configure controls with parameters](https://docs.aws.amazon.com//controltower/latest/controlreference/control-parameter-concepts.html). + + + + +The artifact for this control is the following service control policy (SCP). @@ -42,3 +62 @@ JSON - "Resource": [ - "*" - ], + "Resource": "*", @@ -48 +66 @@ JSON - "arn:aws:iam::*:root" + "arn:*:iam::*:root" @@ -50 +68,4 @@ JSON - } + }{% if ExemptedPrincipalArns %}, + "ArnNotLike": { + "aws:PrincipalArn": {{ExemptedPrincipalArns}} + }{% endif %} @@ -57 +77,0 @@ JSON -## Disallow Actions as a Root User @@ -59 +79,3 @@ JSON -Secures your AWS accounts by disallowing account access with root user credentials, which are credentials of the account owner that allow unrestricted access to all resources in the account. Instead, we recommend that you create IAM Identity Center users for everyday interaction with your AWS account. This is a preventive control with strongly recommended guidance. By default, this control is not enabled. +## [AWS-GR_RESTRICT_ROOT_USER] Disallow actions as a root user + +Secure your AWS accounts by disallowing account access with root user credentials, which are credentials of the account owner and allow unrestricted access to all resources in the account. We recommend that you instead create AWS Identity and Access Management (IAM) users for everyday interaction with your AWS account. @@ -61 +83 @@ Secures your AWS accounts by disallowing account access with root user credentia -The artifact for this control is the following SCP. +This is a preventive control with strongly-recommended guidance based on service control policies (SCPs). By default, this control is not enabled. You can enable this control through the AWS Control Tower console, or though the AWS Control Tower APIs. @@ -63 +85 @@ The artifact for this control is the following SCP. -JSON +**AWS service:** AWS Identity and Access Management (IAM) @@ -64,0 +87 @@ JSON +###### Control metadata @@ -66 +89 @@ JSON -**** + * **Control objective:** Enforce least privilege @@ -67,0 +91,19 @@ JSON + * **Implementation:** Service control policy (SCP) + + * **Control behavior:** Preventive + + * **Control owner:** AWS Control Tower + + * **Resource types:**`AWS::::Account` + + + + +###### Usage considerations + + * This control supports configuration. It contains elements that are included by AWS Control Tower conditionally, based on the configuration you select. This control supports the following configuration parameters: **ExemptedPrincipalArns** , **ExemptAssumeRoot**. For more information, see [Configure controls with parameters](https://docs.aws.amazon.com//controltower/latest/controlreference/control-parameter-concepts.html). + + + + +The artifact for this control is the following service control policy (SCP). @@ -77,3 +119 @@ JSON - "Resource": [ - "*" - ], + "Resource": "*", @@ -83 +123 @@ JSON - "arn:aws:iam::*:root" + "arn:*:iam::*:root" @@ -85 +125,7 @@ JSON - } + }{% if ExemptedPrincipalArns %}, + "ArnNotLike": { + "aws:PrincipalArn": {{ExemptedPrincipalArns}} + }{% endif %}{% if ExemptAssumeRoot %}, + "Null": { + "aws:AssumedRoot": "true" + }{% endif %}