Ensure that IAM policies are attached only to groups or roles.