Check ID: iam_policy_cloudshell_admin_not_attached
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM identities with the AWS managed policy AWSCloudShellFullAccess attached are identified across users, groups, and roles. This indicates principals are granted cloudshell:* on *, enabling full CloudShell features, including environment startup and file transfer.

​
Risk

Granting cloudshell:* enables an interactive shell with Internet egress and file upload/download, degrading confidentiality and integrity. Compromised principals can exfiltrate data, stage tooling with sudo, persist artifacts in CloudShell, and operate from AWS IP space to bypass endpoint controls.

​
Recommendation

Detach AWSCloudShellFullAccess from identities. Apply least privilege: permit CloudShell only when necessary via narrowly scoped permissions, restricted roles, short-lived sessions, and approvals. Prefer controlled alternatives (local CLI, bastion, or Session Manager). Enforce separation of duties and monitor usage.

​
Remediation

# Terraform: ensure AWSCloudShellFullAccess is NOT attached
resource "aws_iam_user_policy_attachment" "<example_resource_name>" {
  count      = 0  # Critical: prevents creation, ensuring the policy is detached/not attached
  user       = "<example_resource_name>"
  policy_arn = "arn:aws:iam::aws:policy/AWSCloudShellFullAccess"  # Denied policy
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_policy_cloudshell_admin_not_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks