Customer managed IAM policy blocks cloudtrail:* privileges

Check ID: iam_policy_no_full_access_to_cloudtrail
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

Custom IAM policies are reviewed for statements that grant full CloudTrail access via the cloudtrail:* wildcard, indicating unrestricted permission to all CloudTrail actions.

Risk

Unrestricted CloudTrail control lets principals stop or alter logging, delete or modify trails, and query events. This enables log evasion, audit tampering, and reconnaissance, undermining the integrity, availability, and confidentiality of audit evidence and detection.

Recommendation

Apply least privilege: avoid cloudtrail:* and allow only required actions. Enforce separation of duties for trail management. Use permissions boundaries or SCPs to block broad CloudTrail access, and validate policies regularly to refine scopes.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam create-policy-version --policy-arn <example_policy_arn> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudtrail:DescribeTrails","Resource":"*"}]}' --set-as-default

# IAM policy without CloudTrail wildcard access
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "cloudtrail:DescribeTrails" # Critical: replaces 'cloudtrail:*' with a specific action, removing full access
      Resource = "*"
    }]
  })
}

# CloudFormation managed policy without CloudTrail wildcard access
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: cloudtrail:DescribeTrails  # Critical: replaces 'cloudtrail:*' with a specific action to remove full access
            Resource: "*"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_policy_no_full_access_to_cloudtrail. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

No principal has AWSCloudShellFullAccess attached Custom IAM policy does not allow 'kms:*' privileges

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires