Cis AWS Foundations 2.13

Ensure IAM users receive permissions only through groups

Description

IAM users are granted access to services, functions, and data through IAM policies. There are four ways to assign policies to a user:

1. Attach an inline (user) policy directly to the user
2. Attach a managed policy directly to the user
3. Add the user to an IAM group with attached policies
4. Add the user to an IAM group with inline policies

Only assigning permissions through IAM groups is recommended.

Rationale

Assigning IAM policies through groups centralizes permissions management and aligns access with organizational roles. This reduces complexity and lowers the likelihood of excessive or inconsistent permissions.

Impact

Directly assigning policies to users increases the risk of misconfigured or excessive permissions and makes access management more difficult to audit and maintain.

Audit Procedure

Using AWS CLI

1. Run the following command to list all IAM users:

aws iam list-users --query 'Users[*].UserName' --output text

2. For each user returned, run:

aws iam list-attached-user-policies --user-name <user-name>
aws iam list-user-policies --user-name <user-name>

3. If any policies are returned, the user has either:

• A directly attached managed policy, or
• An inline policy

Expected Result

For each IAM user, both list-attached-user-policies and list-user-policies should return empty results. All permissions should be assigned through IAM groups only.

Remediation

Using AWS Console

Create and configure a group:

1. Sign in to the AWS Management Console and open the IAM console (https://console.aws.amazon.com/iam/)
2. In the navigation pane, click User Groups and then click Create Group
3. Enter a group name and click Next
4. Select the appropriate policies
5. Click Create Group

Add users to the group:

6. Navigate to User Groups
7. Select the group
8. Click Add users to group
9. Select users and click Add users

Remove direct user policies:

10. Navigate to Users
11. Select the user
12. Go to the Permissions tab
13. Remove any directly attached policies

Using AWS CLI

1. Create a group:

aws iam create-group --group-name <group-name>

2. Attach a policy to the group:

aws iam attach-group-policy --group-name <group-name> --policy-arn <policy-arn>

3. Add user to group:

aws iam add-user-to-group --user-name <user-name> --group-name <group-name>

4. Detach managed policies from user:

aws iam detach-user-policy --user-name <user-name> --policy-arn <policy-arn>

5. Delete inline policies from user:

aws iam delete-user-policy --user-name <user-name> --policy-name <policy-name>

Default Value

By default, AWS allows IAM policies to be attached directly to users, groups, or roles. There are no restrictions preventing direct user policies unless enforced through organizational standards.

References

1. http://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
2. http://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html
3. CCE-78912-3

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 | Automated