Back to Checks
aws

At least one IAM role has the SecurityAudit AWS managed policy attached

iam_securityaudit_role_created
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM roles with the AWS managed SecurityAudit policy (arn:aws:iam::aws:policy/SecurityAudit) are identified. The focus is on whether a role exists that grants read-only visibility into security-relevant configuration across AWS services.

Prowler logoProwlerprowler-provider-aws

Risk

Without a dedicated read-only audit role, security teams lack safe visibility into configs and logs, enabling undetected misconfigurations, slower incident triage, and reliance on over-privileged access. This erodes confidentiality and integrity by letting exposure persist unnoticed.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_securityaudit_role_created

Recommendation

Establish a dedicated audit role and attach the AWS managed SecurityAudit policy. Enforce least privilege and separation of duties: restrict who can assume it, require MFA, monitor usage, and avoid write permissions. Prefer federated access and regularly review and rotate access.

Remediation

CLI

aws iam attach-role-policy --role-name <example_resource_name> --policy-arn arn:aws:iam::aws:policy/SecurityAudit

Terraform

# Minimal IAM role plus attachment of the AWS managed SecurityAudit policy
resource "aws_iam_role" "example" {
  name               = "<example_resource_name>"
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<example_account_id>:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "security_audit" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" # CRITICAL: attaches SecurityAudit to the role to pass the check
}

NativeIaC

# CloudFormation: create a minimal IAM role with SecurityAudit attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<example_account_id>:root
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit  # CRITICAL: attaches the AWS managed SecurityAudit policy to this role, satisfying the check

Other

1In the AWS Console, go to IAM > Roles
2Open any existing role that is appropriate for read-only security auditing
3Click "Add permissions" > "Attach policies"
4Search for "SecurityAudit", check the box for the AWS managed policy named SecurityAudit
5Click "Add permissions" to attach the policy (the account now has at least one role with SecurityAudit attached)

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_securityaudit_role_created(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.entities_role_attached_to_securityaudit_policy is not None:
            if iam_client.entities_role_attached_to_securityaudit_policy:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=iam_client.entities_role_attached_to_securityaudit_policy[
                        0
                    ],
                )
                report.region = iam_client.region
                report.resource_id = "SecurityAudit"
                report.resource_arn = (
                    f"arn:{iam_client.audited_partition}:iam::aws:policy/SecurityAudit"
                )
                report.status = "PASS"
                report.status_extended = f"SecurityAudit policy attached to role {iam_client.entities_role_attached_to_securityaudit_policy[0]['RoleName']}."
            else:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource={},
                )
                report.region = iam_client.region
                report.resource_id = "SecurityAudit"
                report.resource_arn = (
                    f"arn:{iam_client.audited_partition}:iam::aws:policy/SecurityAudit"
                )
                report.status = "FAIL"
                report.status_extended = (
                    "SecurityAudit policy is not attached to any role."
                )
            findings.append(report)
        return findings

References