Back to Checks
aws

At least one IAM role has the AWSSupportAccess managed policy attached

iam_support_role_created
Service: iamSeverity: low
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamRole

Presence of an IAM role that has the AWS managed AWSSupportAccess policy attached, designating a support role for interacting with AWS Support Center and related tooling.

Prowler logoProwlerprowler-provider-aws

Risk

Without a dedicated support role:

  • Case creation and escalation can be delayed, prolonging outages (availability)
  • Teams may use admin/root, increasing blast radius (confidentiality/integrity)
  • Audit trails of support actions are weaker, hindering investigations

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_support_role_created

Recommendation

Create a dedicated IAM role for AWS Support with AWSSupportAccess and:

  • Restrict who can assume it; require MFA and time-bound access
  • Enforce least privilege and separation of duties
  • Monitor usage via audit logs and review assignments regularly

Remediation

CLI

aws iam attach-role-policy --role-name <example_resource_name> --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

Terraform

# IAM role with AWS Support access
resource "aws_iam_role" "example_resource_name" {
  name               = "example_resource_name"
  assume_role_policy = jsonencode({
    Version   = "2012-10-17",
    Statement = [{
      Effect    = "Allow",
      Principal = { AWS = "arn:aws:iam::<example_account_id>:user/<example_resource_name>" },
      Action    = "sts:AssumeRole"
    }]
  })

  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSSupportAccess"  # Critical: ensures this role has AWSSupportAccess (PASS)
  ]
}

NativeIaC

# CloudFormation: create a role with AWS Support access
Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<example_account_id>:user/<example_resource_name>
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSSupportAccess  # Critical: attaches AWS Support access so at least one role has this policy (PASS)

Other

1In the AWS console, go to IAM > Roles
2Select any existing role you can use for support access
3Click Add permissions (or Attach policies)
4Search for "AWSSupportAccess" and select it
5Click Attach policies to save
6This immediately ensures at least one role has the AWSSupportAccess managed policy (PASS).

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_support_role_created(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.entities_role_attached_to_support_policy is not None:
            if iam_client.entities_role_attached_to_support_policy:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=iam_client.entities_role_attached_to_support_policy[0],
                )
                report.region = iam_client.region
                report.resource_id = iam_client.audited_account
                report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSSupportAccess"
                report.status = "PASS"
                report.status_extended = f"AWS Support Access policy attached to role {iam_client.entities_role_attached_to_support_policy[0]['RoleName']}."
            else:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource={},
                )
                report.region = iam_client.region
                report.resource_id = iam_client.audited_account
                report.resource_arn = f"arn:{iam_client.audited_partition}:iam::aws:policy/AWSSupportAccess"
                report.status = "FAIL"
                report.status_extended = (
                    "AWS Support Access policy is not attached to any role."
                )
            findings.append(report)
        return findings

References