Check provider logo

No IAM users, groups, or roles have the AWSCloudShellFullAccess policy attached

iam_policy_cloudshell_admin_not_attached

Severitymedium
Serviceiam
by Prowler
identity-access

IAM identities with the AWS managed policy AWSCloudShellFullAccess attached are identified across users, groups, and roles.

This indicates principals are granted cloudshell:* on *, enabling full CloudShell features, including environment startup and file transfer.

Risk

Granting cloudshell:* enables an interactive shell with Internet egress and file upload/download, degrading confidentiality and integrity.

Compromised principals can exfiltrate data, stage tooling with sudo, persist artifacts in CloudShell, and operate from AWS IP space to bypass endpoint controls.

Run this check with Prowler CLI

prowler aws --checks iam_policy_cloudshell_admin_not_attached

Run in Prowler Cloud

Recommendation

Detach AWSCloudShellFullAccess from identities.

Apply least privilege: permit CloudShell only when necessary via narrowly scoped permissions, restricted roles, short-lived sessions, and approvals. Prefer controlled alternatives (local CLI, bastion, or Session Manager). Enforce separation of duties and monitor usage.

Remediation

Native IaC
Terraform
Other
  1. In the AWS console, go to IAM > Policies
  2. Search for AWSCloudShellFullAccess and open it
  3. Select the Entities attached tab
  4. Select all Users, Groups, and Roles listed
  5. Click Detach and confirm

Source Code

Resource Type

AwsIamPolicy

References