Ermetic announced it has released a
free open source tool for managing AccessDenied Events in Amazon Web Services
(AWS) that automates time consuming cloud access policy troubleshooting and
correction. Access
Undenied on AWS analyzes AWS CloudTrail AccessDenied events, scans the
environment to identify and explain the reasons for the events, and offers
actionable least-privilege remediation suggestions.
The project is led by Noam Daham, research lead at Ermetic. You can read his
blog introducing the tool here.
"Even if you know the policy type causing ‘access denied', which isn't
always the case, you still need to find the policy and the statement inside the
policy causing the denial, and replace it with a least-privilege alternative,"
Noam Dahan. "Basically, you give the Access Undenied on AWS tool a CloudTrail
event with an "Access Denied" outcome, and it will tell you how to fix
it!"
Access Undenied on AWS addresses some of the peskiest Access Denied
challenges encountered by DevOps and security teams on a daily basis,
including:
Some AccessDenied messages still do not provide details. Among the services
for which some, or even many, messages are lacking in detail are: S3, IAM, STS,
CloudWatch, EFS, DynamoDB, Redshift, Opensearch and ACM.
When the reason for AccessDenied is an explicit deny, users can have difficulty
tracking down the specific policy and statement that generated the explicit
deny. Specifically, when the reason is an explicit deny in a service control
policy (SCP), it is difficult to find and assess every single policy in the
organization that applies to the account.
Meanwhile, when the problem is a missing allow statement, it can still be
challenging to create the least-privilege policy that allows the desired access
without granting excessive permissions.
Access Undenied on AWS is available here,
and supports policies for many resources and some of the most common condition
keys. This open source project is also soliciting input from the community
through contributions of new issues
in the repository.