# Ensure IAM policies are attached only to groups or roles - Source: https://support.icompaas.com/support/solutions/articles/a_1793292215101120-ensure-iam-policies-are-attached-only-to-groups-or-roles - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no IAM user has permissions policies attached directly, either as AWS managed or customer managed policies or as inline policies. IAM users should receive their permissions only through membership in IAM groups, and workloads should use IAM roles. **Rationale** Policies attached directly to individual users are hard to review and maintain, and they often lead to users gradually collecting more permissions than they need. If such a user is compromised, the excess permissions can be used to expose data, change resources or move to other parts of the account. Granting permissions through groups and roles keeps access management central, makes least privilege easier to enforce and makes revoking access simpler and more reliable. **Impact** - Centralizes permission management, so access is granted and revoked consistently through groups and roles - Makes access reviews and audits simpler - Removing a policy from a user immediately removes the permissions it granted; the user loses access unless the same permissions are granted through a group first **Default Value** A newly created IAM user has no policies attached. Policies are attached to a user only if an administrator adds them. **Pre-Requisites** - IAM permissions: iam:ListUsers, iam:ListAttachedUserPolicies, iam:ListUserPolicies, iam:GetUserPolicy, iam:DetachUserPolicy, iam:DeleteUserPolicy, iam:CreateGroup, iam:AttachGroupPolicy, iam:PutGroupPolicy and iam:AddUserToGroup - A list of the permissions each affected user actually needs, and the IAM groups that will provide them **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Users** in the left menu. 3. Select a user and open the **Permissions** tab. 4. In **Permissions policies**, check whether any policy is attached directly to the user rather than through a group, including inline policies. 5. Repeat for each IAM user. 6. If any user has a directly attached or inline policy, follow the implementation steps. **CLI:** List all IAM users: aws iam list-users --query "Users\[\].UserName" --output table For each user, list the managed policies attached directly to the user: aws iam list-attached-user-policies --user-name --query "AttachedPolicies\[\].\[PolicyName,PolicyArn\]" --output table For each user, list the inline policies of the user: aws iam list-user-policies --user-name --query "PolicyNames" --output table A user fails if either command returns at least one policy. Each directly attached or inline policy is reported as a separate finding. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **User groups** in the left menu. 3. Create a group (or choose an existing one) that grants the permissions the user needs: - attach the same managed policies that are attached to the user, - for each inline policy of the user, add an inline policy with the same JSON to the group. 4. Add the user to the group. 5. Select **Users** in the left menu, select the user and open the **Permissions** tab. 6. In **Permissions policies**, select each managed policy attached directly to the user and choose **Remove**. 7. Select each inline policy of the user, choose **Remove** and confirm. 8. Repeat for each affected IAM user. **Backout Plan** Before making changes, save the user's directly attached policies and each inline policy document: aws iam list-attached-user-policies --user-name > attached-user-policies-backup.json aws iam get-user-policy --user-name --policy-name > inline-user-policy-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console, select **Users** in the left menu and select the user. 3. On the **Permissions** tab, choose **Add permissions**, select **Attach policies directly** and attach the managed policies listed in the backup. 4. For each saved inline policy, choose **Add permissions**, then **Create inline policy**, paste the saved policy document in the **JSON** editor and save it with its original name. 5. If needed, remove the user from the group that was added. Note: rolling back returns to directly assigned user permissions, which are harder to manage and review. Use it only as a temporary measure. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) - [https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html](https://docs.aws.amazon.com/securityhub/latest/userguide/iam-controls.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_groups\_manage\_attach-policy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_attach-policy.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.