AWS IAM & Organization Audit

Number of APIs: 12

Description

The collection make use of REST API exposed by AWS IAM to fetch data related to IAM entities and their access to AWS resources.

The collection processes fetched data using “Pre-request & Post-requests Tests” to detect nonalignment with the AWS IAM audit checklist.

The audit result is pushed to Slack for further actions for DevOps Team.

Environment Key	Value
awsaccesskey_id	Read: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys
awssecretaccess_key	Read: https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys
slack_url	Read: https://api.slack.com/incoming-webhooks

IAM Audit Checklist ``` 1. Check if root user access keys are disabled.

Check if the strong password policy is set for an AWS account.
Minimum password length (10) Require at least one lowercase letter Require at least one number Require at least one non-alphanumeric character Allow users to change their own password Enable password expiration (365 days) Prevent password reuse (24)
Identify IAM users(humans) whose active access keys are not being rotated for every 45 days.
Identify if IAM users(bots) whose active access keys are not being rotated for every 180 days.
Identify IAM users(humans) who are inactive for more than 180 days.
Identify IAM users(bots) who are inactive for more than 180 days.
Check if the MFA is enabled for IAM users(humans).
Identify all the permissive policies attached to the roles. Permissive policies : where the value of “Principle” or Action is “ * ” (wildcard character).
Identify unused and not recently used (not last accessed in 180 days) permissions provisioned via policies attached with IAM entity (user, group, role, or policy) using service Last Accessed Data. ```