Aligning IAM policies to user personas for AWS Security Hub

October 3, 2021: In the section “Step 3: Create the role for the sysadmin persona,” we’ve corrected step 1 to indicate that sign in occurs through the administrator account, rather than the member account.

AWS Security Hub provides you with a comprehensive view of your security posture across your accounts in Amazon Web Services (AWS) and gives you the ability to take action on your high-priority security alerts. There are several different user personas that use Security Hub, and they typically require different AWS Identity and Access Management (IAM) permissions. Those personas include: a security administrator; a security analyst or engineer on a central security team or in a Cloud Center of Excellence; and a Developer Operations (DevOps) engineer or application builder who is the primary owner of an AWS account. In this post, we show how to deploy sample IAM policies for these three personas.

The first persona, a security administrator or cloud system administrator (sysadmin), is responsible for setting up and configuring Security Hub, and they typically need access to all of the Security Hub APIs to do this work. As part of this work, the sysadmin enables Security Hub on various accounts and Regions, decides which standards and controls should be enabled on which accounts, enables product integrations, creates insights, sets up custom actions and automated remediations, and configures IAM policies for other users.

The second persona, a security analyst or engineer using Security Hub, is part of a central security team, often part of a Cloud Center of Excellence. We often see that cloud security efforts are centralized in Cloud Centers of Excellence within a company. These security analysts or engineers typically have access to the administrator account in Security Hub and can view and take action on findings from any of the connected member accounts. They typically are not configuring Security Hub, so they don’t need permissions to do so.

The third persona is a DevOps engineer or application builder. This user needs the ability to view findings and take action only on the findings associated with their account. For cloud workloads, security is often decentralized down to these users. Security Hub enables them to take more proactive responsibility for the security of their own account by directly viewing and taking action on findings in their account. They typically don’t need permissions to set up and configure Security Hub, because that is done by a central sysadmin.

Overview

The following reference architecture presents an overview of a Security Hub administrator-member account structure and three personas: a security administrator, a security analyst/engineer, and a DevOps engineer.

Figure 1: Reference architecture

In this blog post, we show how you can create and use the following AWS managed and customer managed IAM policies to support these three personas:

• The sysadmin persona needs permissions to configure and manage Security Hub, account memberships, insights, and integrations, and to create remediations and take actions and perform record and workflow updates. The AWS managed IAM policy called AWSSecurityHubFullAccess provides the permissions for this persona. An IAM role with these permissions can deploy and configure Security Hub in administrator and member accounts. They can also update findings. The sysadmin also requires permissions to configure AWS Config and Amazon CloudWatch event rules to set up automated responses and remediations.
• The security analyst persona needs permissions to read, list, and describe findings, standards, controls, and products; to update findings; and to create and update insights for Security Hub resources in the administrator account. The AWS managed IAM policy called AWSSecurityHubReadOnlyAccess provides the permissions needed for read, list, and describe actions, and a customer managed policy will be attached to give permissions to create and update insights and to update findings.
• The DevOps engineer persona needs the same permissions as the security analyst persona, but they will only have the ability to access their own Security Hub member AWS account(s) and won’t have access to the administrator account.

Depending on your specific use case, you might want to provide additional permissions to the security analyst and DevOps engineer personas. For example, you might want to also grant them permissions to create custom actions by using the UpdateActionTarget API. In that case, you should also ensure that they have appropriate permissions to create CloudWatch event rules. You can also restrict these personas to only be able to update certain fields in findings (for example, only update workflow status but not severity) by using IAM context keys.

Prerequisites

You must have already enabled Security Hub with one account as administrator and other associated accounts as members. You will use the following AWS services:

• AWS Security Hub
• AWS Identity and Access Management (IAM)

Implementation

To create the required customer managed policies and associate them to roles, you will perform these tasks, described in more detail later in this section:

1. Create a customer managed policy and associate it with the role for the security analyst persona in the Security Hub administrator account, along with the AWSSecurityHubReadOnlyAccess AWS managed policy.
2. Create a customer managed policy and associate it with the role for the DevOps persona in the Security Hub member account, along with the AWSSecurityHubReadOnlyAccess AWS managed policy.
3. Create a sysadmin role and associate it with the AWS managed policy for AWSSecurityHubFullAccess, along with AWS Config and CloudWatch event rule permissions in the Security Hub administrator account.

The following policy JSON script is for those two customer managed policies.

Security Hub - Security Analyst policy 
AdministratorCustomer Managed Policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SecurityAnalystAdministratorCMP",
            "Effect": "Allow",
            "Action": [
                "securityhub:UpdateInsight",
                "securityhub:CreateInsight",
	  			"securityhub:BatchUpdateFindings"
            ],
            "Resource": "*"
        }
    ]
}

Security Hub – DevOps Engineer policy: 
MemberCustomer Managed Policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DevOpsMemberCMP",
            "Effect": "Allow",
            "Action": [
                "securityhub:UpdateInsight",
                "securityhub:CreateInsight",
                "securityhub:BatchUpdateFindings"
            ],
            "Resource": "*"
        }
    ]
}

Step 1: Create a role for the security analyst persona

First, create a customer managed policy and associate it with the role for the security analyst persona in the Security Hub administrator account, along with the AWSSecurityHubReadOnlyAccess AWS managed policy.

To create the IAM policy and role (console method)

1. Sign in to the AWS Management Console in the Security Hub administrator account and open the IAM console.
2. In the IAM console navigation pane, choose Policies, and then choose Create Policies.
3. Choose the JSON tab.
4. Copy the Security Hub – Security Analyst policy JSON shown earlier in this section, and paste it into the visual editor. When you are finished, choose Review policy.
5. On the Review policy page, enter a name and a description (optional) for the policy that you’re creating. Review the policy summary to see the permissions that are granted by your policy. Then choose Create policy to save your work.
6. Follow the instructions in the AWS Identity and Access Management User Guide to create a role and attach the policy you just created.
7. In the IAM console navigation pane, choose the role that you just created, and on the Permissions tab, choose Add Permissions.
8. Choose the permissions category Attach existing policies directly to filter and select the managed policy AWSSecurityHubReadOnlyAccess. Review the permissions and then choose Add permissions.
9. Save all the changes and try using the role after a few minutes.

Step 2: Create the role for the DevOps persona

Next, create a customer managed policy and associate it with the role for the DevOps persona in the Security Hub member account, along with the AWSSecurityHubReadOnlyAccess AWS managed policy.

To create the IAM policy and role (console method)

1. Sign in to the AWS Management Console in the Security Hub member account and open the IAM console.
2. In the IAM console navigation pane, choose Policies and then choose Create Policies.
3. Choose the JSON tab.
4. Copy the Security Hub – DevOps Engineer policy JSON shown earlier in this section, and paste it into the visual editor. When you are finished, choose Review policy.
5. On the Review policy page, enter a name and a description (optional) for the policy that you are creating. Review the policy summary to see the permissions that are granted by your policy. Then choose Create policy to save your work.
6. Follow the instructions in the AWS Identity and Access Management User Guide to create a role and attach the policy you just created.
7. In the IAM console navigation pane, choose the role that you just created, and on the Permissions tab, choose Add Permissions.
8. Choose the permissions category Attach existing policies directly to filter and select the managed policy AWSSecurityHubReadOnlyAccess. Review the permissions and then choose Add permissions.
9. Save all the changes and try using the role after a few minutes.

Step 3: Create the role for the sysadmin persona

Next, create a role for the sysadmin persona and associate it with the AWS managed policies AWSSecurityHubFullAccess, CloudWatchEventsFullAccess, and full access to AWS Config in the Security Hub administrator account.

To create the IAM role (console method)

1. Sign in to the AWS Management Console in the Security Hub administrator account and open the IAM console.
2. Follow the instructions in the AWS Identity and Access Management User Guide to create a role.
3. In the IAM console navigation pane, choose the role that you just created, and on the Permissions tab, choose Add Permissions.
4. Choose the permissions category Attach existing policies directly to filter and select managed policies, and attach the managed policies AWSSecurityHubFullAccess and CloudWatchEventsFullAccess.
5. Create another policy to grant full access to AWS Config as described in the AWS Config Developer Guide, and attach the policy to the role. Review the permissions, and choose Add permissions.
6. Save all the changes and try using the role after a few minutes.

Test the roles in the Security Hub administrator and member accounts

Finally, test the three roles (using IDP and federation or different ways to assume roles) that you created for the respective personas in the preceding steps.

To test the roles

1. Security analyst role:
   1. Sign in to the AWS Management Console in the administrator account and open Security Hub.
   2. Make sure that Security Hub UI features (such as the Summary, Security Standard, Insights, Findings, and Integrations) are rendered so that the Security Analyst can view them.
   3. Navigate to a finding and change the workflow status as described in the topic Setting the workflow status for findings.
   4. Assume the role and test the Security Hub APIs specific to the access provided for the security analyst.
2. DevOps engineer role:
   1. Sign in to the AWS Management Console in the member account and open Security Hub.
   2. Make sure that Security Hub UI features (such as the Summary, Security Standard, Insights, Findings, and Integrations) are rendered so that the DevOps Engineer can view them.
   3. Create a custom insight for the member account and other attribute groupings.
   4. Assume the role and test the Security Hub APIs specific to the access provided for the DevOps engineer.
3. Sysadmin role:
   1. Sign in to the AWS Management Console in the administrator or member account, and open Security Hub.
   2. Try admin-related operations such as create a custom action, invite another account, and so on.
   3. Assume the role and test the Security Hub APIs specific to the access provided for the sysadmin.

Adding policy conditions

You might want to further restrict the permissions for the security analyst and DevOps personas. IAM policies for Security Hub’s BatchUpdateFindings API enable you to specify conditions to prevent a user from making any update to a specific finding field. The following example disallows setting the Workflow Status field to Suppressed.

{
	"Sid": "CMPCondition",
	"Effect": "Deny",
	"Action": "securityhub:BatchUpdateFindings",
	"Resource": "*",
	"Condition": {
		"StringEquals": {
			"securityhub:ASFFSyntaxPath/Workflow.Status": "SUPPRESSED"
		}
	}
}

Summary

In this post, we showed you how to align AWS managed and customer managed IAM policies to different user personas, so that you can allow different users to access Security Hub with least privilege permissions. Security Hub enables both central security teams and individual DevOps engineers to understand and improve the security posture of the AWS accounts in their organization.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, start a new thread on the AWS Security Hub forum or contact AWS Support.

Want more AWS Security how-to content, news, and feature announcements? Follow us on Twitter.