IAM User Should Not Have Any Inline or Attached Policies Rule
This rule states that IAM users should not have any inline or attached policies for security reasons.
| Rule | IAM user should not have any inline or attached policies |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ Low |
Rule Description
The rule states that IAM users should not have any inline or attached policies that are not compliant with NIST 800-53 Revision 5. This rule is important for maintaining the security and compliance of the AWS environment and preventing unauthorized access or inappropriate permissions for IAM users.
Troubleshooting Steps
If an IAM user is found with non-compliant inline or attached policies, the following troubleshooting steps can be taken:
- 1.Identify the IAM user(s) with non-compliant policies.
- 2.Determine the specific policy/policies that are not compliant with NIST 800-53 Revision 5.
- 3.Review the policy to understand the specific issues or violations.
- 4.Analyze the impact of the non-compliant policy on the AWS environment's security and compliance.
Necessary Codes
No specific codes are required for this rule. However, you can utilize AWS CLI commands for listing and modifying IAM policies if necessary during the remediation process.
Remediation Steps
To remediate the non-compliant inline or attached policies for IAM users, follow these step-by-step guide:
- 1.Login to the AWS Management Console with appropriate credentials.
- 2.Open the IAM console.
- 3.Select "Users" from the left-hand menu.
- 4.Identify the IAM user(s) with non-compliant policies.
- 5.Click on the IAM user's name to access their details page.
- 6.Scroll down to the "Permissions" section.
- 7.Review the list of inline and attached policies associated with the user.
- 8.Identify the non-compliant policies and take note of their names and descriptions.
Detaching Non-Compliant Policies
If there are non-compliant policies attached to the IAM user, follow these steps to detach them:
- 1.Click on the policy name that is non-compliant.
- 2.In the policy details page, click on the "Detach" button.
- 3.Confirm the detachment when prompted.
Deleting Non-Compliant Inline Policies
If there are non-compliant inline policies, follow these steps to delete them:
- 1.Click on the "Inline Policies" tab.
- 2.Select the non-compliant policy name from the list.
- 3.Click on the "Delete Policy" button.
- 4.Confirm the deletion when prompted.
Verification
After detaching or deleting the non-compliant inline or attached policies, follow these steps to verify compliance:
- 1.Select "Users" from the left-hand menu in the IAM console.
- 2.Click on the IAM user's name that was previously non-compliant.
- 3.Scroll down to the "Permissions" section.
- 4.Confirm that there are no non-compliant inline or attached policies listed.
By following the above remediation steps, you can ensure that IAM users do not have any inline or attached policies that violate NIST 800-53 Revision 5.