Check ID: iam_inline_policy_no_full_access_to_cloudtrail
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM inline policies are evaluated for statements that grant full CloudTrail permissions (cloudtrail:*) to all resources. The finding flags identity policies that provide unrestricted control over CloudTrail operations.

​
Risk

Full CloudTrail access allows stopping trails, modifying configurations, or deleting audit data, compromising log integrity and availability. It also exposes event data, impacting confidentiality. Adversaries could hide activity, evade detection, and obstruct investigations.

​
Recommendation

Enforce least privilege and separation of duties: avoid cloudtrail:*; grant only specific actions needed (prefer read-only where possible). Add guardrails or boundaries to block destructive actions. Use managed, centrally governed policies and periodically right-size permissions based on usage.

​
Remediation

resource "aws_iam_role_policy" "<example_resource_name>" {
  name = "<example_resource_name>-policy"
  role = "<example_resource_name>"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["cloudtrail:DescribeTrails"] # Critical: replace 'cloudtrail:*' with specific action(s) to remove full service access
      Resource = "*"
    }]
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_inline_policy_no_full_access_to_cloudtrail. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks