Check Details

• Resource: Users
• Check: Enforce group permission
• Risk: Directly attached user policies can lead to inconsistent and excessive permissions

Remediation via AWS Console

1. Sign in to the AWS Management Console and open the IAM console.
2. In the left navigation panel, click Users and select an IAM user.
3. Open the Permissions tab to review directly attached policies.
4. Create an IAM group (if not already present):
   • In the left navigation pane, click User groups
   • Click Create group
   • Enter a group name
   • Attach the required permission policies
   • Click Create group
   
5. Attach the required permissions to the group:
   • Select the group
   • Open the Permissions tab
   • Click Add permissions and attach required policies
   • Save the changes
   
6. Add the IAM user to the appropriate group:
   • Open Users
   • Select the IAM user
   • Click Add user to groups
   • Select the appropriate group
   • Click Add
   
7. Remove directly attached policies from the user:
   • Go back to the Permissions tab of the IAM user
   • Under Attached directly, select each policy
   • Click Remove and confirm
   
8. Repeat these steps for all IAM users.

Remediation via AWS CLI

1. Log in to the AWS Management Console and click the CloudShell icon (>_) in the top-right corner.
2. List all IAM users:

   
   
   aws iam list-users \
    --query "Users[*].UserName" \
    --output table
   

3. Check for policies directly attached to a user:

   
   
   aws iam list-attached-user-policies \
    --user-name <user-name>
   

   If policy ARNs are returned, the user has direct permissions and the check is failing.

4. Create an IAM group (if required):

   
   
   aws iam create-group --group-name <group-name>
   

5. Attach required policies to the group:

   
   
   aws iam attach-group-policy \
    --group-name <group-name> \
    --policy-arn arn:aws:iam::aws:policy/<policy-name>
   

6. Add the IAM user to the group:

   
   
   aws iam add-user-to-group \
    --user-name <user-name> \
    --group-name <group-name>
   

7. Remove directly attached policies from the user:

   
   
   aws iam detach-user-policy \
    --user-name <user-name> \
    --policy-arn <policy-arn>