T Cloud Public is extending Config with five predefined IAM compliance policies. These policies allow you to continuously evaluate relevant IAM configurations against your security and governance requirements.
The new policies provide visibility into noncompliant configurations, helping you detect configuration drift and review overly broad permissions.
New IAM compliance policies
- AccessKey Rotation Check: Identifies IAM users whose access key has not been rotated within the specified number of days as noncompliant.
- Admin Permissions Check: Identifies custom policies or roles that allow all actions across all cloud services.
- Custom Policies Should Not Allow All Actions for a Service: Identifies custom policies or roles that allow all actions for an individual cloud service.
- The Admin User Group Only Contains the Root User: Identifies non-root users in the admin user group as noncompliant.
- Multi-Factor Authentication Check: Identifies IAM users without multi-factor authentication enabled as noncompliant.
How to use the new policies
- In the T Cloud Public Console, open Config and select Resource Compliance. Create a rule and choose a predefined policy with the iam tag.
- Configure any applicable rule parameters, such as the access key rotation period. Config evaluates the relevant resources; review the results and remediate deviations where required.
Outlook
- These five policies are the first batch of new IAM governance policies in Config. Additional policies are planned.
A more detailled description of the new rules can be found in the T Cloud Public Community as a Blog Post.