IAM Groups Rule: Ensuring at Least One User
This rule emphasizes that IAM groups must have at least one user assigned, ensuring security and access control.
| Rule | IAM groups should have at least one user |
| Framework | NIST Cybersecurity Framework (CSF) v1.1 |
| Severity | ✔ High |
Rule Description:
IAM (Identity and Access Management) groups should have at least one user assigned to them in compliance with the NIST Cybersecurity Framework (CSF) version 1.
The NIST CSF provides a structured approach to managing and reducing cybersecurity risk. One of the key components of the framework is the proper management of user access and privileges within an organization's IT infrastructure. Ensuring that IAM groups have at least one user assigned helps enforce the principle of least privilege and reduces the risk of unauthorized access to sensitive systems and data.
Troubleshooting Steps:
If an IAM group does not have any users assigned to it, it indicates a potential compliance issue with the NIST CSF. To troubleshoot and resolve this issue, follow these steps:
- 1.Identify the IAM group without any users assigned.
- 2.Verify if any users should be added to the group based on their roles and responsibilities within the organization.
- 3.In the AWS Management Console, navigate to the IAM service.
- 4.Select "Groups" from the sidebar menu.
- 5.Locate the group in question and click on its name.
- 6.In the "Users" tab, check if any users are currently assigned to the group. If not, proceed to the next step.
- 7.Click on the "Add Users to Group" button.
- 8.Search for the appropriate user(s) and select them.
- 9.Click on the "Add Users" button to add them to the group.
- 10.Verify that the users have been successfully added to the group.
- 11.Repeat the process for any other IAM groups found without assigned users.
Necessary Codes:
No code snippets are required for this rule.
Step-by-step Guide for Remediation:
- 1.Log in to your AWS Management Console.
- 2.Open the IAM service.
- 3.In the sidebar menu, click on "Groups".
- 4.Identify the IAM group for remediation.
- 5.Click on the name of the group.
- 6.In the "Users" tab, check if any users are currently assigned to the group. If not, proceed to the next step.
- 7.Click on the "Add Users to Group" button.
- 8.Search for the appropriate user(s) and select them.
- 9.Click on the "Add Users" button to add them to the group.
- 10.Verify that the users have been successfully added to the group.
- 11.Repeat the process for any other IAM groups found without assigned users.
Note: It is recommended to regularly review and verify the users assigned to each IAM group to ensure compliance with the NIST CSF and maintain a secure access control framework.