Back to Checks
aws

Inline IAM policy does not allow 'aws-marketplace:Subscribe' on all resources

iam_inline_policy_no_wildcard_marketplace_subscribe
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:gen-aiidentity-access
Resource Type:AwsIamPolicy

IAM inline policies are analyzed to identify statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.

Prowler logoProwlerprowler-provider-aws

Risk

Granting aws-marketplace:Subscribe on all resources via inline policies allows subscribing to any Marketplace product, including expensive Bedrock foundation models, leading to uncontrolled costs, shadow AI usage, and compliance violations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_inline_policy_no_wildcard_marketplace_subscribe

Recommendation

Replace Resource: "*" with specific, approved AWS Marketplace product ARNs. Prefer managed policies over inline and apply the principle of least privilege to aws-marketplace:Subscribe permissions to prevent unauthorized subscriptions to costly Bedrock models and other Marketplace products.

Remediation

Terraform

resource "aws_iam_role_policy" "scoped_marketplace_subscribe" {
  name = "scoped-marketplace-subscribe"
  role = aws_iam_role.example.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["aws-marketplace:Subscribe"]
      Resource = ["arn:aws:aws-marketplace::123456789012:product/approved-product-id"]  # FIX: scope to specific products
    }]
  })
}

NativeIaC

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      Policies:
        - PolicyName: scoped-marketplace-subscribe
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - aws-marketplace:Subscribe  # FIX: scope to specific product ARNs
                Resource:
                  - arn:aws:aws-marketplace::123456789012:product/approved-product-id

Other

1In the AWS Console, open IAM and go to Users, Roles, or Groups where the inline policy is attached
2Select the entity, go to the Permissions tab, and open the inline policy
3Click Edit policy and switch to the JSON editor
4Replace "Resource": "*" with specific, approved AWS Marketplace product ARNs
5Save changes and re-run the check to confirm it passes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.iam.lib.policy import (
    policy_allows_marketplace_subscribe_on_all_resources,
)


class iam_inline_policy_no_wildcard_marketplace_subscribe(Check):
    def execute(self) -> list[Check_Report_AWS]:
        findings = []
        for policy in iam_client.policies.values():
            if policy.type == "Inline":
                report = Check_Report_AWS(metadata=self.metadata(), resource=policy)
                report.region = iam_client.region
                report.resource_id = f"{policy.entity}/{policy.name}"
                report.status = "PASS"

                resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]
                resource_attached = report.resource_arn.split("/")[-1]

                report.status_extended = f"Inline policy {policy.name}{' attached to ' + resource_type_str + ' ' + resource_attached if policy.attached else ''} does not allow 'aws-marketplace:Subscribe' on all resources."

                if (
                    policy.document
                    and policy_allows_marketplace_subscribe_on_all_resources(
                        policy.document
                    )
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Inline policy {policy.name}{' attached to ' + resource_type_str + ' ' + resource_attached if policy.attached else ''} allows 'aws-marketplace:Subscribe' on all resources."

                findings.append(report)
        return findings

References