Skip to main content

​
More Info:

Data exfiltration is defined as when an authorized person extracts data from the secured systems where it belongs, and either shares it with unauthorized third parties or moves it to insecure systems. Authorized persons include employees, system administrators, and trusted users. Data exfiltration can occur due to the actions of malicious or compromised actors, or accidentally

​
Risk Level

High

​
Address

Security

​
Compliance Standards

CISGCP,HIPAA,SCO2,NISTCSF,NIST,AWSWAF,ISO27001,HITRUST,CBP

​
Triage and Remediation

  • Remediation

​
Remediation

Using Console

To remediate the permissions leading to data exfiltration in AWS IAM, follow these steps using the AWS Management Console:
  1. Sign in to the AWS Management Console.
  2. Open the IAM console.
  3. Navigate to the “Policies” section in the left-hand menu.
  4. Identify the policy that grants excessive permissions and may lead to data exfiltration. This could be a custom policy or an AWS managed policy.
  5. Click on the policy to view its details.
  6. Review the policy document to understand the permissions it grants and identify the specific actions that need to be revoked or restricted.
  7. Click on the “Edit policy” button to modify the policy.
  8. Update the policy document to remove or restrict the excessive permissions. You can either remove the entire statement granting the permission or modify it to restrict the resource or actions allowed.
  9. Review the changes to ensure that the policy now adheres to the principle of least privilege, granting only the necessary permissions.
  10. Click on the “Review policy” button to validate the changes made to the policy.
  11. Review the summary of changes and ensure that the policy is now correctly configured.
  12. Click on the “Save changes” button to apply the modified policy.
Once the policy is updated, the users or roles associated with the policy will have their permissions restricted according to the changes made. This will help mitigate the risk of data exfiltration resulting from excessive permissions.Remember to regularly review and audit your IAM policies to ensure that they continue to adhere to the principle of least privilege and align with your organization’s security requirements.

​

Remediating all the listed exfiltration actions in AWS using the AWS CLI involves adjusting or restricting permissions for the associated IAM policies and resource policies. Below are examples of how you can remediate each of the specified actions:
  1. dynamodb:BatchExecuteStatement:
    • Review and adjust IAM policies for the user or role to remove or restrict the dynamodb:BatchExecuteStatement action. Use aws iam commands to modify the associated policies.
  2. dynamodb:BatchGetItem:
    • Similarly, review and adjust IAM policies to remove or restrict the dynamodb:BatchGetItem action.
  3. dynamodb:GetItem:
    • Modify IAM policies to remove or restrict dynamodb:GetItem.
  4. dynamodb:TransactGetItems:
    • Update IAM policies to remove or restrict the dynamodb:TransactGetItems action.
  5. ec2:AttachVolume:
    • Review and modify the IAM policies associated with EC2 instances or roles to remove or restrict the ec2:AttachVolume action.
  6. ec2:CopySnapshot:
    • Adjust IAM policies related to EC2 instances to remove or restrict the ec2:CopySnapshot action.
  7. ec2:CreateReplaceRootVolumeTask:
    • Modify IAM policies for EC2 to remove or restrict the ec2:CreateReplaceRootVolumeTask action.
  8. ec2:CreateSnapshot:
    • Update IAM policies related to EC2 to remove or restrict the ec2:CreateSnapshot action.
  9. ec2:CreateSnapshots:
    • Modify IAM policies for EC2 to remove or restrict the ec2:CreateSnapshots action.
  10. ec2:CreateTags:
    • Review and adjust IAM policies associated with EC2 to remove or restrict the ec2:CreateTags action.
  11. ec2:CreateVolume:
    • Modify IAM policies for EC2 to remove or restrict the ec2:CreateVolume action.
  12. ec2:DetachVolume:
    • Update IAM policies related to EC2 to remove or restrict the ec2:DetachVolume action.
  13. ec2:ModifySnapshotAttribute:
    • Adjust IAM policies for EC2 to remove or restrict the ec2:ModifySnapshotAttribute action.
  14. ec2:ModifySnapshotTier:
    • Review and modify IAM policies related to EC2 to remove or restrict the ec2:ModifySnapshotTier action.
  15. ec2:ModifyVolume:
    • Modify IAM policies for EC2 to remove or restrict the ec2:ModifyVolume action.
  16. ec2:ModifyVolumeAttribute:
    • Update IAM policies associated with EC2 to remove or restrict the ec2:ModifyVolumeAttribute action.
  17. ec2:ResetSnapshotAttribute:
    • Review and adjust IAM policies related to EC2 to remove or restrict the ec2:ResetSnapshotAttribute action.
  18. ec2:RestoreSnapshotFromRecycleBin:
    • Modify IAM policies for EC2 to remove or restrict the ec2:RestoreSnapshotFromRecycleBin action.
  19. ec2:RestoreSnapshotTier:
    • Review and modify IAM policies associated with EC2 to remove or restrict the ec2:RestoreSnapshotTier action.
  20. iam:GetUser:
    • Modify IAM policies to remove or restrict the iam:GetUser action.
  21. kms:Decrypt:
    • Review and adjust the Key Policy for the KMS key to remove or restrict the kms:Decrypt action using aws kms.
  22. rds:CopyDBClusterSnapshot:
    • Adjust IAM policies related to RDS to remove or restrict the rds:CopyDBClusterSnapshot action.
  23. rds:CopyDBSnapshot:
    • Modify IAM policies for RDS to remove or restrict the rds:CopyDBSnapshot action.
  24. rds:CreateDBClusterSnapshot:
    • Review and adjust IAM policies associated with RDS to remove or restrict the rds:CreateDBClusterSnapshot action.
  25. rds:CreateDBInstanceReadReplica:
    • Update IAM policies related to RDS to remove or restrict the rds:CreateDBInstanceReadReplica action.
  26. rds:CreateDBSnapshot:
    • Modify IAM policies for RDS to remove or restrict the rds:CreateDBSnapshot action.
  27. rds:ModifyDBCluster:
    • Review and adjust IAM policies associated with RDS to remove or restrict the rds:ModifyDBCluster action.
  28. rds:ModifyDBClusterSnapshotAttribute:
    • Adjust IAM policies related to RDS to remove or restrict the rds:ModifyDBClusterSnapshotAttribute action.
  29. rds:ModifyDBInstance:
    • Update IAM policies related to RDS to remove or restrict the rds:ModifyDBInstance action.
  30. rds:ModifyDBSnapshot:
    • Modify IAM policies for RDS to remove or restrict the rds:ModifyDBSnapshot action.
  31. rds:ModifyDBSnapshotAttribute:
    • Review and adjust IAM policies associated with RDS to remove or restrict the rds:ModifyDBSnapshotAttribute action.
  32. rds:ModifyGlobalInstance:
    • Update IAM policies related to RDS to remove or restrict the rds:ModifyGlobalInstance action.
  33. rds:Select:
    • Modify IAM policies for RDS to remove or restrict the rds:Select action.
  34. s3:CopyObject:
    • Review and adjust S3 bucket policies to remove or restrict the s3:CopyObject action using aws s3api.
  35. s3:GetBucketTagging:
    • Modify S3 bucket policies to remove or restrict the s3:GetBucketTagging action using aws s3api.
  36. s3:GetObject:
    • Review and adjust S3 bucket policies to remove or restrict the s3:GetObject action using aws s3api.
  37. s3:HeadBucket:
    • Update S3 bucket policies to remove or restrict the s3:HeadBucket action using aws s3api.
  38. s3:HeadObject:
    • Adjust S3 bucket policies to remove or restrict the s3:HeadObject action using aws s3api.
  39. s3:PutBucketPolicy:
    • Review and modify S3 bucket policies to remove or restrict the s3:PutBucketPolicy action using aws s3api.
  40. s3:PutObjectAcl:
    • Modify S3 bucket policies to remove or restrict the s3:PutObjectAcl action using aws s3api.
  41. s3:RestoreObject:
    • Update S3 bucket policies to remove or restrict the s3:RestoreObject action using aws s3api.
  42. s3:SelectObjectContent:
    • Adjust S3 bucket policies to remove or restrict the s3:SelectObjectContent action using aws s3api.
  43. secretsmanager:GetSecretValue:
    • Modify Secrets Manager resource policies to remove or restrict the secretsmanager:GetSecretValue action using aws secretsmanager.
  44. ssm:GetParameter:
    • Update IAM policies or parameter policies in SSM to remove or restrict the ssm:GetParameter action using aws ssm.
  45. ssm:GetParameters:
    • Modify IAM policies or parameter policies in SSM to remove or restrict the ssm:GetParameters action using aws ssm.
  46. ssm:GetParametersByPath:
    • Adjust IAM policies or parameter policies in SSM to remove or restrict the ssm:GetParametersByPath action using aws ssm.
Please replace placeholders such as <RoleName>, <BucketName>, <KeyId>, and <SecretId> with the actual resource names in your AWS environment. Always test policy changes in a safe environment to avoid unintended access issues.
Remediating the specified exfiltration actions in AWS using Python involves making API calls to modify the necessary policies and permissions. You can use the AWS SDK for Python (Boto3) to interact with AWS services and implement the remediation steps. Below, is provided a general outline of how to remediate some of the actions with Python scripts. You can adapt these examples for your specific use case.Make sure you have the Boto3 library installed (pip install boto3) and configured with the necessary AWS credentials before running the scripts.Note: The following examples provide a high-level overview, and you should tailor them to your specific needs.
  1. IAM Policies and Permissions: To remediate IAM-related actions, you can use Boto3 to update IAM policies. Here’s an example of how to remove a permission from an IAM policy: 
    import boto3

iam = boto3.client('iam')

policy_name = "YourPolicyName"
policy_document = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "dynamodb:BatchExecuteStatement",
            "Resource": "*"
        },
        # Other statements...
    ]
}

iam.put_group_policy(
    GroupName="YourGroupName",
    PolicyName=policy_name,
    PolicyDocument=json.dumps(policy_document)
)
    Modify the policy_document to suit your specific needs.
  2. S3 Bucket Policies: To remediate S3-related actions, you can use Boto3 to update S3 bucket policies. Here’s an example to deny s3:CopyObject: 
    import boto3

s3 = boto3.client('s3')

bucket_name = "YourBucketName"
policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "s3:CopyObject",
            "Resource": f"arn:aws:s3:::{bucket_name}/*",
            "Principal": "*"
        },
        # Other statements...
    ]
}

s3.put_bucket_policy(Bucket=bucket_name, Policy=json.dumps(policy))
    Adjust the policy to match your requirements.
  3. KMS Key Policies: To remediate KMS-related actions, you can use Boto3 to adjust the KMS key policy. Here’s an example to deny kms:Decrypt: 
    import boto3

kms = boto3.client('kms')

key_id = "YourKMSKeyID"
policy = {
    "Sid": "DenyDecrypt",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "kms:Decrypt",
    "Resource": f"arn:aws:kms:us-east-1:123456789012:key/{key_id}"
}

kms.put_key_policy(
    KeyId=key_id,
    PolicyName="default",
    Policy=json.dumps(policy)
)
    Customize the policy to meet your needs.
  4. RDS Security Groups and Network ACLs: To remediate RDS-related actions, you can use Boto3 to modify security group rules or network ACLs. These scripts can be more complex and require fetching existing rules and updating them. The exact code will depend on your specific requirements.
  5. Secrets Manager and Parameter Store: To remediate actions related to Secrets Manager and Parameter Store, you can use Boto3 to adjust access policies. For Secrets Manager, you can use secretsmanager and for Parameter Store, you can use ssm. For example, to deny secretsmanager:GetSecretValue: 
    import boto3

secrets_manager = boto3.client('secretsmanager')

secret_id = "YourSecretID"
resource_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "secretsmanager:GetSecretValue",
            "Resource": f"arn:aws:secretsmanager:us-east-1:123456789012:secret:{secret_id}",
            "Principal": "*"
        },
        # Other statements...
    ]
}

secrets_manager.put_resource_policy(
    SecretId=secret_id,
    ResourcePolicy=json.dumps(resource_policy)
)
    Modify the resource_policy as needed.
These are just starting points for remediating the specified actions using Python. The actual implementation will depend on your specific AWS environment and requirements. Always test remediation scripts in a safe environment and follow best practices for security and policy management.
.
⌘I