IAM identity has AWSCloudShellFullAccess policy attached

Severity: Medium
Service: IAM
Check ID: CLOUDSHELL_FULLACCESS_ATTACHED

What this check finds

AWSCloudShellFullAccess grants unrestricted browser-based shell access to AWS. Commands run in CloudShell are logged differently than direct API calls, reducing visibility. This policy should not be attached to any IAM user, role, or group.

Passing looks like: No AWSCloudShellFullAccess attached.

How to fix it

Detach AWSCloudShellFullAccess from all IAM identities.

AWS CLI

aws iam detach-user-policy --user-name USERNAME --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess

Repeat for roles and groups that have it attached.
If CloudShell access is required, create a scoped policy instead of using the full-access managed policy.

Names in capitals are placeholders for your own resource. Review a command before you run it.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM identity has AWSCloudShellFullAccess policy attached
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.21 Ensure access to AWSCloudShellFullAccess is restricted
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.8.2 Privileged access rights A.8.18 Use of privileged utility programs

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks