Panther medium experimental python

AWS CloudTrail Least Privilege Access

Users with permissions to disable or reconfigure CloudTrail should be limited.

View Source

Detection Logic

CLOUDTRAIL_MANAGED_POLICY_ARN = "arn:aws:iam::aws:policy/AWSCloudTrailFullAccess"
MAX_ADMIN_USERS = 2


def policy(resource):
    return (
        CLOUDTRAIL_MANAGED_POLICY_ARN in resource["ManagedPolicyARNs"]
        and len(resource["Users"]) <= MAX_ADMIN_USERS
    )

Field Validations

Loading…

Comments (0)

Loading comments...