Check ID: iam_policy_attached_only_to_group_or_roles
Provider: AWS
Service: iam
Severity: LOW
Categories: identity-access
Resource type: AwsIamUser

​
What this check verifies

IAM users have identity-based policies attached directly (managed or inline) instead of inheriting permissions via groups or roles.

​
Risk

Directly attached user policies hinder centralized control and cause privilege creep. If a user is compromised, excessive rights enable data exposure, resource tampering, and lateral movement, harming confidentiality and integrity. Revocation is error-prone, weakening separation of duties and auditability.

​
Recommendation

Assign permissions to groups (humans) and roles (workloads); avoid user-attached policies. Enforce least privilege, prefer federation and temporary credentials, and use tags or permissions boundaries to constrain scope. Review regularly to remove direct user policies and right-size access.

​
Remediation

# CloudFormation: ensure IAM user has no policies
Resources:
  <example_resource_name>:
    Type: AWS::IAM::User
    Properties:
      UserName: <example_resource_name>
      ManagedPolicyArns: []  # CRITICAL: empty list detaches all managed (attached) policies
      Policies: []           # CRITICAL: empty list removes all inline policies

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_policy_attached_only_to_group_or_roles. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks