Description

Ensure that no IAM user has permissions policies attached directly, either as AWS managed or customer managed policies or as inline policies. IAM users should receive their permissions only through membership in IAM groups, and workloads should use IAM roles.

Rationale

Policies attached directly to individual users are hard to review and maintain, and they often lead to users gradually collecting more permissions than they need. If such a user is compromised, the excess permissions can be used to expose data, change resources or move to other parts of the account. Granting permissions through groups and roles keeps access management central, makes least privilege easier to enforce and makes revoking access simpler and more reliable.

Impact

  • Centralizes permission management, so access is granted and revoked consistently through groups and roles

  • Makes access reviews and audits simpler

  • Removing a policy from a user immediately removes the permissions it granted; the user loses access unless the same permissions are granted through a group first

Default Value

A newly created IAM user has no policies attached. Policies are attached to a user only if an administrator adds them.

Pre-Requisites

  • IAM permissions: iam:ListUsers, iam:ListAttachedUserPolicies, iam:ListUserPolicies, iam:GetUserPolicy, iam:DetachUserPolicy, iam:DeleteUserPolicy, iam:CreateGroup, iam:AttachGroupPolicy, iam:PutGroupPolicy and iam:AddUserToGroup

  • A list of the permissions each affected user actually needs, and the IAM groups that will provide them

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Users in the left menu.

  3. Select a user and open the Permissions tab.

  4. In Permissions policies, check whether any policy is attached directly to the user rather than through a group, including inline policies.

  5. Repeat for each IAM user.

  6. If any user has a directly attached or inline policy, follow the implementation steps.

CLI:

List all IAM users:

aws iam list-users --query "Users[].UserName" --output table

For each user, list the managed policies attached directly to the user:

aws iam list-attached-user-policies --user-name <USER_NAME> --query "AttachedPolicies[].[PolicyName,PolicyArn]" --output table

For each user, list the inline policies of the user:

aws iam list-user-policies --user-name <USER_NAME> --query "PolicyNames" --output table

A user fails if either command returns at least one policy. Each directly attached or inline policy is reported as a separate finding.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select User groups in the left menu.

  3. Create a group (or choose an existing one) that grants the permissions the user needs:

    • attach the same managed policies that are attached to the user,

    • for each inline policy of the user, add an inline policy with the same JSON to the group.

  4. Add the user to the group.

  5. Select Users in the left menu, select the user and open the Permissions tab.

  6. In Permissions policies, select each managed policy attached directly to the user and choose Remove.

  7. Select each inline policy of the user, choose Remove and confirm.

  8. Repeat for each affected IAM user.

Backout Plan

Before making changes, save the user's directly attached policies and each inline policy document:

aws iam list-attached-user-policies --user-name <USER_NAME> > attached-user-policies-backup.json
aws iam get-user-policy --user-name <USER_NAME> --policy-name <POLICY_NAME> > inline-user-policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Users in the left menu and select the user.

  3. On the Permissions tab, choose Add permissions, select Attach policies directly and attach the managed policies listed in the backup.

  4. For each saved inline policy, choose Add permissions, then Create inline policy, paste the saved policy document in the JSON editor and save it with its original name.

  5. If needed, remove the user from the group that was added.

Note: rolling back returns to directly assigned user permissions, which are harder to manage and review. Use it only as a temporary measure.

Reference