No IAM role with AWSSupportAccess exists for incident management

Severity: Low
Service: IAM
Check ID: SUPPORT_ROLE_NOT_CONFIGURED

What this check finds

CIS requires a dedicated IAM role with the AWSSupportAccess managed policy so incidents can be managed with AWS Support without using root or full-admin credentials. Without this role, opening support cases requires excessive privileges.

Passing looks like: Support role for incident management configured.

How to fix it

Create an IAM role and attach AWSSupportAccess.

AWS CLI

aws iam create-role --role-name AWSSupportRole --assume-role-policy-document "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::ACCOUNT_ID:root\"},\"Action\":\"sts:AssumeRole\"}]}" && aws iam attach-role-policy --role-name AWSSupportRole --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Roles → Create role → attach AWSSupportAccess.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to No IAM role with AWSSupportAccess exists for incident management
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.16 Ensure a support role has been created to manage incidents with AWS Support
NIST SP 800-53 Rev5 (Moderate)	IR-7 Incident Response Assistance
NIST Cybersecurity Framework 2.0	RS.MA-01 The incident response plan is executed
ISO/IEC 27001:2022 Annex A	A.5.24 Information security incident management planning and preparation

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks