Inline IAM policy does not allow 'aws-marketplace:Subscribe' on all resources
iam_inline_policy_no_wildcard_marketplace_subscribe
IAM inline policies are analyzed to identify statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.
Risk
Granting aws-marketplace:Subscribe on all resources via inline policies allows subscribing to any Marketplace product, including expensive Bedrock foundation models, leading to uncontrolled costs, shadow AI usage, and compliance violations.
prowler aws --checks iam_inline_policy_no_wildcard_marketplace_subscribe
Recommendation
Replace Resource: "*" with specific, approved AWS Marketplace product ARNs. Prefer managed policies over inline and apply the principle of least privilege to aws-marketplace:Subscribe permissions to prevent unauthorized subscriptions to costly Bedrock models and other Marketplace products.
Remediation
- In the AWS Console, open IAM and go to Users, Roles, or Groups where the inline policy is attached
- Select the entity, go to the Permissions tab, and open the inline policy
- Click Edit policy and switch to the JSON editor
- Replace "Resource": "*" with specific, approved AWS Marketplace product ARNs
- Save changes and re-run the check to confirm it passes
Source Code
Resource Type
AwsIamPolicy
References
Related To
- iam_policy_no_wildcard_marketplace_subscribe