Description

Ensure that at least one IAM role in the account has the AWS managed policy AWSSupportAccess attached. This role is used by authorized people to open and manage cases with AWS Support and to use the AWS Support Center.

Rationale

Without a dedicated support role, opening and escalating support cases during an incident can be delayed, which can prolong outages. Teams may also fall back to using administrator accounts or the root user to contact AWS Support, which gives them far more access than needed. A dedicated role with AWSSupportAccess, whose use is restricted and monitored, supports least privilege, separation of duties and a clear audit trail of support actions.

Impact

  • Allows authorized staff to manage AWS Support cases without administrator or root access

  • Provides a clear audit trail of who assumed the role to work with AWS Support

  • No effect on existing workloads; only the principals allowed in the role's trust policy can use it

Default Value

No IAM role with the AWSSupportAccess policy exists by default.

Pre-Requisites

  • IAM permissions: iam:ListEntitiesForPolicy, iam:CreateRole and iam:AttachRolePolicy

  • A decision on which users or accounts may assume the support role

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies in the left menu.

  3. Search for and select AWSSupportAccess.

  4. Open the Entities attached tab and check whether at least one role is listed.

  5. If no role is listed, follow the implementation steps.

CLI:

List the roles that have the AWSSupportAccess policy attached:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --entity-filter Role --query "PolicyRoles[].RoleName"

The account fails if no role is returned. Users or groups with the policy attached do not count.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Roles in the left menu.

  3. Choose Create role.

  4. Select AWS account as the trusted entity type, choose This account (or enter the account that will assume the role) and choose Next.

  5. Search for and select AWSSupportAccess, then choose Next.

  6. Enter a role name, for example aws-support-role, and choose Create role.

  7. Allow only the people responsible for AWS Support cases to assume the role.

CLI:

Save the following trust policy as support-role-trust-policy.json, replacing <ACCOUNT_ID> with the account whose users may assume the role:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::<ACCOUNT_ID>:root"},"Action":"sts:AssumeRole"}]}

Create the role:

aws iam create-role --role-name <ROLE_NAME> --assume-role-policy-document file://support-role-trust-policy.json

Attach the AWSSupportAccess policy to the role:

aws iam attach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Roles in the left menu and select the support role.

  3. On the Permissions tab, select AWSSupportAccess and choose Remove.

  4. If the role was created only for this purpose, choose Delete and confirm.

CLI:

aws iam detach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess
aws iam delete-role --role-name <ROLE_NAME>

Note: without a support role, staff may need administrator or root access to contact AWS Support during an incident.

Reference