All checks
Low
IAM users should not have IAM policies attached
Checks that no IAM user has a policy attached directly, managed or inline; users should get permissions from IAM groups or by assuming a role. Grants made one user at a time grow hard to review as users are added and tend to outlast the need, while a group is one place to review and revoke.
- service
- IAM
- severity
- Low
- scope
- evaluated once per account
How to fix it
- Can break clients: Add the user to the group before removing anything from the user, or they lose those permissions in between, as each change applies at once.
- Affects another check: If the policy is AWSCloudShellFullAccess, moving it to a group leaves IAM.27 failing on that group; that check wants it removed outright.
In the console
IAM → Users → the user → Permissions policies
- Add user to groups
- A group carrying the same permissions; recreate any inline policy's statements on the group first
- Permissions policies
- None attached directly or inline; Remove on a row Attached via a group takes the user out of it
With the AWS CLI
aws iam detach-user-policy --user-name <user-name> --policy-arn <policy-arn>With Terraform
resource "aws_iam_group_policy_attachment" "this" {
group = var.group_name
policy_arn = var.policy_arn
}See which of your accounts this check is failing on.
Book a live scan