Help Center/ Config/ User Guide/ Resource Compliance/ Built-In Policies/ Identity and Access Management/ All IAM Policies Are in Use
Updated on 2024-10-15 GMT+08:00
View PDF
Share

All IAM Policies Are in Use

Rule Details

Table 1 Rule details

Parameter

Description

Rule Name

iam-policy-in-use

Identifier

iam-policy-in-use

Description

If an IAM policy has not been attached to any IAM users, user groups, or agencies, this policy is noncompliant.

Tag

iam

Trigger Type

Configuration change

Filter Type

iam.policies

Rule Parameter

None

Applicable Scenario

This rule allows you to detect IAM policies that haven't been attached to any IAM users, user groups, or agencies, so that you can avoid unintended authorization with these policies.

Solution

If you need the detected unused policies, attach these policies to IAM users, user groups or agencies. If you do not, delete them.

Rule Logic

  • If an IAM policy has been attached to an IAM user, user group, or agency, this policy is compliant.
  • If an IAM policy has not been attached to any IAM users, user groups, or agencies, this policy is noncompliant.