SEC03-BP03 - Establish emergency access process

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "EmergencyAccessRole",
      "Effect": "Allow",
      "Action": [
        "ec2:*",
        "rds:*",
        "s3:*",
        "cloudwatch:*",
        "logs:*"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        },
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": "3600"
        }
      }
    }
  ]
}

# Create an emergency access role
aws iam create-role \
  --role-name EmergencyAccessRole \
  --assume-role-policy-document file://trust-policy.json \
  --description "Role for emergency access to critical resources"

# Attach the emergency access policy
aws iam put-role-policy \
  --role-name EmergencyAccessRole \
  --policy-name EmergencyAccessPolicy \
  --policy-document file://emergency-policy.json

# Set up CloudTrail alerting for emergency role usage
aws events put-rule \
  --name "EmergencyRoleUsageAlert" \
  --event-pattern '{
    "source": ["aws.sts"],
    "detail-type": ["AWS API Call via CloudTrail"],
    "detail": {
      "eventSource": ["sts.amazonaws.com"],
      "eventName": ["AssumeRole"],
      "requestParameters": {
        "roleArn": ["arn:aws:iam::123456789012:role/EmergencyAccessRole"]
      }
    }
  }'

# Emergency Access Procedure

## Criteria for Emergency Access
Emergency access should only be used when:
1. There is a critical production incident affecting business operations
2. Normal access methods are unavailable or insufficient
3. Immediate action is required to resolve the issue
4. The issue cannot be resolved through standard procedures

## Emergency Access Request Process
1. Requestor identifies need for emergency access
2. Requestor contacts the on-call security team via the emergency hotline
3. Requestor provides:
   - Name and employee ID
   - Nature of the emergency
   - Systems requiring access
   - Estimated duration needed
4. Security team validates the request and identity of the requestor
5. If approved, security team provides access to sealed credentials or approves role assumption

## Using Emergency Access
1. Log in using the emergency credentials or assume the emergency role
2. Enable session recording if possible
3. Perform only the necessary actions to resolve the emergency
4. Document all actions taken during the emergency access session
5. Terminate the session as soon as the emergency is resolved

## Post-Emergency Process
1. Notify the security team that the emergency is resolved
2. Submit a detailed report within 24 hours including:
   - Actions taken during the emergency session
   - Root cause of the emergency
   - Recommendations to prevent similar emergencies
3. Participate in a post-incident review
4. Security team rotates emergency credentials

## Auditing and Compliance
All emergency access events will be:
1. Logged in CloudTrail and CloudWatch
2. Reviewed by the security team
3. Included in compliance reports
4. Subject to regular audits

description: 'Automation for emergency access to production environment'
schemaVersion: '0.3'
assumeRole: '{{AutomationAssumeRole}}'
parameters:
  AutomationAssumeRole:
    type: String
    description: Role for automation to assume
  EmergencyAccessRole:
    type: String
    description: Role ARN for emergency access
    default: arn:aws:iam::123456789012:role/EmergencyAccessRole
  RequestorARN:
    type: String
    description: ARN of the identity requesting emergency access
  JustificationText:
    type: String
    description: Justification for emergency access
  DurationSeconds:
    type: String
    description: Duration for emergency access (in seconds)
    default: '3600'
    allowedPattern: '^[0-9]+$'
mainSteps:
  - name: ValidateRequest
    action: 'aws:executeAwsApi'
    inputs:
      Service: iam
      Api: GetUser
      UserName: '{{RequestorARN}}'
    isCritical: true
    nextStep: NotifySecurityTeam
  - name: NotifySecurityTeam
    action: 'aws:executeAwsApi'
    inputs:
      Service: sns
      Api: Publish
      TopicArn: arn:aws:sns:us-west-2:123456789012:EmergencyAccessAlerts
      Subject: 'Emergency Access Request'
      Message: 'Emergency access requested by {{RequestorARN}} with justification: {{JustificationText}}'
    nextStep: GrantAccess
  - name: GrantAccess
    action: 'aws:executeAwsApi'
    inputs:
      Service: sts
      Api: AssumeRole
      RoleArn: '{{EmergencyAccessRole}}'
      RoleSessionName: 'EmergencyAccess-{{RequestorARN}}'
      DurationSeconds: '{{DurationSeconds}}'
    outputs:
      - Name: AccessKeyId
        Selector: $.Credentials.AccessKeyId
      - Name: SecretAccessKey
        Selector: $.Credentials.SecretAccessKey
      - Name: SessionToken
        Selector: $.Credentials.SessionToken
    nextStep: LogAccessGrant
  - name: LogAccessGrant
    action: 'aws:executeAwsApi'
    inputs:
      Service: cloudtrail
      Api: LookupEvents
      LookupAttributes:
        - AttributeKey: EventName
          AttributeValue: AssumeRole
    isEnd: true