# Ensure No Inline IAM Policies Allowed

- Source: https://support.icompaas.com/support/solutions/articles/62000224014-ensure-no-inline-iam-policies-allowed
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [IAM Policies](https://support.icompaas.com/support/solutions/folders/62000096130)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

An inline policy is a policy that's embedded in an IAM identity (a user, group, or role). That is, the policy is an inherent part of the identity. You can create a policy and embed it in an identity, either when you create the identity or later.

The following diagram illustrates inline policies. Each policy is an inherent part of the user, group, or role. Notice that two roles include the same policy (the **DynamoDB-books-app** policy), but they are not sharing a single policy; each role has its own copy of the policy.![](https://support.icompaas.com/assets/kb/208047a93544a82f.png)

### **Rationale:**

Inline policies are useful if you want to maintain a strict one-to-one relationship between a policy and the identity that it's applied to. Defining access permissions for your IAM groups using managed policies can offer multiple benefits, such as reusability, versioning, rollback, automatic updates, a larger policy size, and fine-grained control over your policies assignment. a config rule that checks that the inline policy feature is not in use. The rule is non-compliant if an AWS Identity and Access Management (IAM) user, IAM role, or IAM group has any inline policy.

![        Diagram of inline policies      ](https://support.icompaas.com/assets/kb/402172fd33f0beae.png)

### **Impact:**

When you change a customer-managed policy, the changed policy doesn't overwrite the existing policy. Instead, IAM creates a new version of the managed policy. IAM stores up to five versions of your customer-managed policies. You can use policy versions to revert a policy to an earlier version if you need to

## **Default Value:**

Policies let you specify who has access to AWS resources and what actions they can perform on those resources. Every IAM user starts with no permissions. In other words, by default, users can do nothing, not even view their own access keys

  

#### **Pre-Requisite:**

-   Must have a user group with the required permissions

**Remediation**

**Test Plan:**

First, we want to  determine if your IAM groups have any inline policies attached or not,

**01:** Sign into the AWS Management Console.

**02:** Navigate to the IAM dashboard at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").

**03:** On the left navigation panel, choose **User Groups**. ![](https://support.icompaas.com/assets/kb/ce58f4f48b7ed64a.png) 

**04:** Select the group that you want to examine.

![](https://support.icompaas.com/assets/kb/a620f2f3d8f61595.png)

**05**: On the IAM group configuration page, select the **Permissions** tab. 

![](https://support.icompaas.com/assets/kb/afd6006b7bf669e9.png)

**06**: Inside the **Inline Policies** section, search for any existing inline policies. If one or more policies are listed, ![](https://support.icompaas.com/assets/kb/c670ef470f19cbd3.png)

In the type, if you notice customer-inline, then it's correct; otherwise, follow the implementation steps. 

### **CLI Commands**

To know about the policy

 aws iam get-group-policy  
\--group-name <value>  
\--policy-name <value>

### **Implementation Steps:**

**Step 01**: Sign into the AWS Management Console.

**Step 02:** Navigate to the IAM dashboard at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").

**Step 03**: In the left navigation panel, choose **User Groups**.![](https://support.icompaas.com/assets/kb/86041856de40d8d7.png)

**Step 04**:Select the IAM group that has inline policies attached (see Audit section) and click on the group name to access its configuration page. ![](https://support.icompaas.com/assets/kb/cde6cabdfa0dadfa.png) 

**Step 05**:On the IAM group configuration page, select the **Permissions** tab.

![](https://support.icompaas.com/assets/kb/744eec1f2faa61e8.png)

**Step 06**: Click on add permissions.

![](https://support.icompaas.com/assets/kb/62603bf2b03f9317.png)

**Step 07:** Click on create Inline Policy.

![](https://support.icompaas.com/assets/kb/a3be5fc331281d89.png)

**Step 08:** Select the service you want  to add 

![](https://support.icompaas.com/assets/kb/04f349b8a9161f5f.png)

**Step 09:** Choose the Action which you want.

![](https://support.icompaas.com/assets/kb/7b1279ae3648eedf.png)

**Step 10:** Click on the Resources that you want to specify

![](https://support.icompaas.com/assets/kb/1167f1920c30c833.png)

**Step 11:** Click on Review Policy

**Step 12:** Provide the name of the policy

![](https://support.icompaas.com/assets/kb/8ff7d4e9c141ec6f.png)

**Step 13:** Click on create policy

### **CLI Commands**

To create the policy

aws iam create-policy  
  --policy-name s3-bucket-management-policy  
  --policy-document file://s3-bucket-management-policy.json

To attach the policy to a group

aws iam attach-group-policy  
  --policy-arn arn:aws:iam::123456789012:policy/s3-bucket-management-policy  
  --group-name aws-s3-managers

**Back out Plan:**

**Step 01:** Sign into the AWS Management Console.

**Step 02:** Navigate to the IAM dashboard at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/ "https://console.aws.amazon.com/iam/").

**Step 03:** In the left navigation panel, choose **User Groups**.

**Step 04:** Select the IAM group that has inline policies attached (see Audit section) and click on the group name to access its configuration page.

**Step 05:** On the IAM group configuration page, select the **Permissions** tab.

![](https://support.icompaas.com/assets/kb/f735a89534aa5fec.png)

**Step 06:** Select the policy and click on remove.

![](https://support.icompaas.com/assets/kb/5633ed99753ae883.png)

![](https://support.icompaas.com/assets/kb/59a1d82b6c743c6b.png)

### CLI Commands

To detach the policy from the user group

  

 aws iam detach-group-policy  
\--group-name <value>  
\--policy-arn <value>

### **Reference:**

[![](https://support.icompaas.com/assets/kb/b0077ffc4bd8765e.png)Managed policies and inline policies - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html) 

[![](https://support.icompaas.com/assets/kb/845a1b8f733ad25a.png)iam — AWS CLI 1.27.94 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/iam/index.html) 

[![](https://support.icompaas.com/assets/kb/14a419ea8fbc635e.png)create-policy — AWS CLI 1.27.91 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy.html) 

[![](https://support.icompaas.com/assets/kb/a5d470a4ff8cc46d.png)get-group-policy — AWS CLI 1.27.90 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/iam/get-group-policy.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.