Back to Checks
aws

No IAM users, groups, or roles have the AWSCloudShellFullAccess policy attached

iam_policy_cloudshell_admin_not_attached
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM identities with the AWS managed policy AWSCloudShellFullAccess attached are identified across users, groups, and roles.

This indicates principals are granted cloudshell:* on *, enabling full CloudShell features, including environment startup and file transfer.

Prowler logoProwlerprowler-provider-aws

Risk

Granting cloudshell:* enables an interactive shell with Internet egress and file upload/download, degrading confidentiality and integrity.

Compromised principals can exfiltrate data, stage tooling with sudo, persist artifacts in CloudShell, and operate from AWS IP space to bypass endpoint controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_policy_cloudshell_admin_not_attached

Recommendation

Detach AWSCloudShellFullAccess from identities.

Apply least privilege: permit CloudShell only when necessary via narrowly scoped permissions, restricted roles, short-lived sessions, and approvals. Prefer controlled alternatives (local CLI, bastion, or Session Manager). Enforce separation of duties and monitor usage.

Remediation

Terraform

# Terraform: ensure AWSCloudShellFullAccess is NOT attached
resource "aws_iam_user_policy_attachment" "<example_resource_name>" {
  count      = 0  # Critical: prevents creation, ensuring the policy is detached/not attached
  user       = "<example_resource_name>"
  policy_arn = "arn:aws:iam::aws:policy/AWSCloudShellFullAccess"  # Denied policy
}

NativeIaC

# CloudFormation: ensure AWSCloudShellFullAccess is NOT attached to the IAM user
Resources:
  <example_resource_name>:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns: []  # Critical: empty list ensures AWSCloudShellFullAccess is not attached

Other

1In the AWS console, go to IAM > Policies
2Search for AWSCloudShellFullAccess and open it
3Select the Entities attached tab
4Select all Users, Groups, and Roles listed
5Click Detach and confirm

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_policy_cloudshell_admin_not_attached(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.entities_attached_to_cloudshell_policy:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource=iam_client.entities_attached_to_cloudshell_policy,
            )
            report.region = iam_client.region
            report.resource_id = iam_client.audited_account
            report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSCloudShellFullAccess"
            entities = iam_client.entities_attached_to_cloudshell_policy

            if entities["Users"] or entities["Groups"] or entities["Roles"]:
                report.status = "FAIL"
                attached_entities = [
                    (key, ", ".join(entities[key]))
                    for key in ["Users", "Groups", "Roles"]
                    if entities[key]
                ]
                entity_strings = [
                    f"{entity[0]}: {entity[1]}" for entity in attached_entities
                ]
                report.status_extended = f"AWS CloudShellFullAccess policy attached to IAM {', '.join(entity_strings)}."
            else:
                report.status = "PASS"
                report.status_extended = (
                    "AWS CloudShellFullAccess policy is not attached to any IAM entity."
                )

            findings.append(report)

        return findings

References