Back to Checks
aws

Custom IAM policy does not allow 'aws-marketplace:Subscribe' on all resources

iam_policy_no_wildcard_marketplace_subscribe
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:gen-aiidentity-access
Resource Type:AwsIamPolicy

Customer-managed IAM policies are examined for statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.

Prowler logoProwlerprowler-provider-aws

Risk

Granting aws-marketplace:Subscribe on all resources allows subscribing to any Marketplace product, including expensive Bedrock foundation models, leading to uncontrolled costs, shadow AI usage, and compliance violations from unapproved deployments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_policy_no_wildcard_marketplace_subscribe

Recommendation

Replace Resource: "*" with specific, approved AWS Marketplace product ARNs. Apply the principle of least privilege to aws-marketplace:Subscribe permissions to prevent unauthorized subscriptions to costly Bedrock models and other Marketplace products.

Remediation

CLI

aws iam create-policy-version --policy-arn <POLICY_ARN> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["aws-marketplace:Subscribe"],"Resource":"arn:aws:aws-marketplace::<ACCOUNT_ID>:product/<PRODUCT_ID>"}]}' --set-as-default

Terraform

resource "aws_iam_policy" "scoped_marketplace_subscribe" {
  name = "scoped-marketplace-subscribe"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["aws-marketplace:Subscribe"]
      Resource = ["arn:aws:aws-marketplace::123456789012:product/approved-product-id"]  # FIX: scope to specific products
    }]
  })
}

NativeIaC

Resources:
  ScopedMarketplacePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - aws-marketplace:Subscribe  # FIX: scope to specific product ARNs
            Resource:
              - arn:aws:aws-marketplace::123456789012:product/approved-product-id

Other

1In the AWS Console, open IAM > Policies
2Find the custom policy that allows aws-marketplace:Subscribe on Resource: *
3Click Edit and switch to the JSON editor
4Replace "Resource": "*" with specific, approved AWS Marketplace product ARNs
5Save changes and re-run the check to confirm it passes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.iam.lib.policy import (
    policy_allows_marketplace_subscribe_on_all_resources,
)


class iam_policy_no_wildcard_marketplace_subscribe(Check):
    def execute(self) -> list[Check_Report_AWS]:
        findings = []
        for policy in iam_client.policies.values():
            if policy.type == "Custom":
                if not policy.attached and not iam_client.provider.scan_unused_services:
                    continue
                report = Check_Report_AWS(metadata=self.metadata(), resource=policy)
                report.region = iam_client.region
                report.status = "PASS"
                report.status_extended = f"Custom Policy {policy.name} does not allow 'aws-marketplace:Subscribe' on all resources."

                if (
                    policy.document
                    and policy_allows_marketplace_subscribe_on_all_resources(
                        policy.document
                    )
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Custom Policy {policy.name} allows 'aws-marketplace:Subscribe' on all resources."

                findings.append(report)
        return findings

References