# 1.17 Ensure a Support Role Has Been Created to Manage Incidents with AWS Support (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233156-1-17-ensure-a-support-role-has-been-created-to-manage-incidents-with-aws-support-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1** ## **Description** AWS provides a Support Center for incident response, technical support, and customer service. To securely manage incidents with AWS Support, an IAM role should be created and assigned appropriate policies to control access to AWS Support. ## Rationale: Least Privilege Access: - Ensures that only authorized users can access AWS Support to manage incidents. - Prevents unauthorized users from opening or modifying AWS Support cases. Incident Management Readiness: - Allows designated personnel to quickly escalate and manage AWS Support cases. Compliance & Accountability: - Ensures proper access control for security and compliance requirements (SOC 2, ISO 27001, etc.). ## Impact **Benefits:** - Securely manage AWS support cases without granting full admin access. - Enhances security by implementing the principle of least privilege. - Improves compliance with security and incident response best practices. **Potential Challenges:** -  If no support role exists, incidents may be delayed due to lack of access. - Overuse of admin privileges increases security risks if AWS Support permissions are assigned to all users. ## Default Value: - By default, AWS accounts do not have a dedicated IAM role for managing support cases. - AdministratorAccess and other policies may already grant AWS Support access, but it is best practice to use a dedicated support role. ## Pre-Requisites: AWS Account Access: - IAM permissions to create roles and policies. Required IAM Permissions: { "Action": \[ "iam:ListPolicies", "iam:CreateRole", "iam:AttachRolePolicy", "iam:ListEntitiesForPolicy" \], "Effect": "Allow", "Resource": "\*" } AWS Support Plan: - A Business or Enterprise Support Plan is required to open technical support cases. ## Remediation - ### Test Plan: Ensure that an IAM role with AWS Support access exists and is assigned the AWSSupportAccess managed policy. **Using AWS CLI:** - List IAM policies and filter for 'AWSSupportAccess': aws iam list-policies --query "Policies\[?PolicyName == 'AWSSupportAccess'\]" - Check if the 'AWSSupportAccess' policy is attached to any IAM role: aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess - If the output does not return any attached roles, the AWS Support role must be created. ## Implementation Steps: Using AWS Console: 1. Login to AWS Console with IAM permissions. 2. Navigate to IAM Service: [AWS IAM Console](https://console.aws.amazon.com/iam/). 3. Click Roles in the left navigation panel.                          ![](https://support.icompaas.com/assets/kb/a69a58644f62d865.png) 4. Click Create Role → AWS Service → Select AWS Support as the use case.                         ![](https://support.icompaas.com/assets/kb/933da1b9e238fc7b.png) 5. Click Next: Permissions and attach the AWSSupportAccess policy.                           ![](https://support.icompaas.com/assets/kb/ef395b05d0cec236.png) 6. Click Next: Tags, add metadata if needed. 7. Click Next: Review, enter a role name like "AWS\_Support\_Role", and click Create Role.                   ![](https://support.icompaas.com/assets/kb/7acf066a081c92a4.png) ![](https://support.icompaas.com/assets/kb/5251605006ffdd8b.png) **Using AWS CLI:** - Create a trust policy for the AWS Support role and save it as TrustPolicy.json: { "Version": "2012-10-17", "Statement": \[ { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "sts:AssumeRole" } \] } - Create the IAM role using the above trust policy: aws iam create-role --role-name AWS\_Support\_Role --assume-role-policy-document file://TrustPolicy.json - Attach the 'AWSSupportAccess' managed policy to the role: aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name AWS\_Support\_Role - Verify that the role has been created successfully: aws iam list-roles --query "Roles\[?RoleName=='AWS\_Support\_Role'\]" Backout Plan: If the support role causes issues: Remove the AWS Support IAM role: aws iam delete-role --role-name AWS\_Support\_Role Verify that no AWS Support access is granted to unauthorized users: aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess 1. Recreate the role if required, following the implementation steps. ## References: - [AWS IAM Managed Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) - [AWS Support Plan Pricing](https://aws.amazon.com/premiumsupport/pricing/) - [AWS CLI: List IAM Policies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/list-policies.html) - [AWS CLI: Attach Role Policy](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/attach-role-policy.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

17.1

Designate at least one key person and one backup to manage incident handling. Review annually or after major organizational changes.

CIS v7

14.1

Ensure network segmentation based on sensitivity level to minimize incident impact.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.