Check Details

• Resource: General
• Check: Establish support role
• Risk: Inability to manage AWS support incidents securely

Remediation via AWS Console

1. Log in to the AWS Management Console and open the IAM service.

   

2. Under Access management, click Policies.

   

3. In the policy search field, search for AWSSupportAccess.

   
4. Click the policy name AWSSupportAccess.

5. Open the Entities attached tab and click Attach.

   

6. Select the appropriate IAM role or roles and click Attach policy.

   

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.

   

2. Create a trust policy file:

   

   nano /tmp/TrustPolicy.json
   

   Replace <iam_user> with the IAM user ARN and paste:

   

   {
   "Version": "2012-10-17",
   "Statement": [
   {
   "Effect": "Allow",
   "Principal": {
   "AWS": "<iam_user>"
   },
   "Action": "sts:AssumeRole"
   }
   ]
   }
   

   Press CTRL + O → Enter → CTRL + X.

3. Create the IAM role:

   

   aws iam create-role \
   --role-name <aws_support_iam_role> \
   --assume-role-policy-document file:///tmp/TrustPolicy.json
   

   

4. Attach AWS Support permissions to the role:

   

   aws iam attach-role-policy \
   --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess \
   --role-name <aws_support_iam_role>
   

5. Verify the role has the required policy attached:

   

   aws iam list-attached-role-policies \
   --role-name <aws_support_iam_role>