Which compliance frameworks require ensure glue crawlers have appropriate iam roles with least privilege?

This security check is required by the following compliance frameworks: SOC 2, Least Privilege.

MEDIUM

Ensure Glue crawlers have appropriate IAM roles with least privilege

Crawler IAM roles should only have permissions to read data sources and write to specific catalog databases.

Security Impact

Overly permissive crawler roles increase blast radius if crawler is compromised or misconfigured.

How to Remediate

Create specific IAM roles for crawlers with read access to source buckets and write access to catalog only. Avoid using broad policies.

Affected Resources

AWS::IAM::RoleAWS::Glue::Crawler

Compliance Frameworks

SOC 2Least Privilege

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

Continuous Scanning
Automatically scans all AWS Glue resources across your AWS accounts every hour
Instant Alerts
Get notified via Slack, email, or webhooks when this misconfiguration is detected
One-Click Remediation
Fix this issue directly from the TigerGate dashboard with our guided remediation
Compliance Evidence
Automatically collect audit evidence for SOC 2, Least Privilege compliance
Drift Detection
Get alerted if this configuration drifts back to an insecure state after remediation