Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts
iam_role_cross_account_readonlyaccess_policy
Ensure IAM Roles do not have ReadOnlyAccess access for external AWS accounts
Risk
The AWS-managed ReadOnlyAccess policy is highly potent and exposes the customer to a significant data leakage threat. It should be granted very conservatively. For granting access to 3rd party vendors, consider using alternative managed policies, such as ViewOnlyAccess or SecurityAudit.
Run this check with Prowler CLI
prowler aws --checks iam_role_cross_account_readonlyaccess_policy
ARN template
arn:partition:service:region:account-id:resource-id
Remediation
Remove the AWS-managed ReadOnlyAccess policy from all roles that have a trust policy, including third-party cloud accounts, or remove third-party cloud accounts from the trust policy of all roles that need the ReadOnlyAccess policy.
Source Code
Resource Type
AwsIamRole