IAM Users Do Not Have Directly Assigned Policies or Permissions

Rule Details

Applicable Scenario

To assign IAM users permissions, you are advised to add users to a user group and assign permissions to the user group. This makes it easier to manage permissions and helps prevent excessive authorization. For more details, see Assigning Permissions to an IAM User.

Solution

You can remove the policies or permissions from noncompliant IAM users and then, create a user group, add the users to the user group, and add the policies or permissions to the user group.

Rule Logic

• If an IAM user has any directly assigned policies or permissions, the IAM user is noncompliant.
• If an IAM user does not have directly assigned policies or permissions, the IAM user is compliant.