An IAM role has the SecurityAudit policy attached

Check ID: iam_securityaudit_role_created
Provider: AWS
Service: iam
Severity: LOW
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

IAM roles with the AWS managed SecurityAudit policy (arn:aws:iam::aws:policy/SecurityAudit) are identified. The focus is on whether a role exists that grants read-only visibility into security-relevant configuration across AWS services.

Risk

Without a dedicated read-only audit role, security teams lack safe visibility into configs and logs, enabling undetected misconfigurations, slower incident triage, and reliance on over-privileged access. This erodes confidentiality and integrity by letting exposure persist unnoticed.

Recommendation

Establish a dedicated audit role and attach the AWS managed SecurityAudit policy. Enforce least privilege and separation of duties: restrict who can assume it, require MFA, monitor usage, and avoid write permissions. Prefer federated access and regularly review and rotate access.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam attach-role-policy --role-name <example_resource_name> --policy-arn arn:aws:iam::aws:policy/SecurityAudit

# Minimal IAM role plus attachment of the AWS managed SecurityAudit policy
resource "aws_iam_role" "example" {
  name               = "<example_resource_name>"
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "AWS": "arn:aws:iam::<example_account_id>:root" },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "security_audit" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/SecurityAudit" # CRITICAL: attaches SecurityAudit to the role to pass the check
}

# CloudFormation: create a minimal IAM role with SecurityAudit attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<example_account_id>:root
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SecurityAudit  # CRITICAL: attaches the AWS managed SecurityAudit policy to this role, satisfying the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_securityaudit_role_created. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

IAM user does not have active access keys older than 90 days An IAM role has the AWSSupportAccess policy attached

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires