Deprecated or flawed AWS managed policy in use

Severity: High
Service: IAM
Check ID: IAM_KNOWN_BAD_POLICY

What this check finds

AWS has provided flawed policies to customers. These are either deprecated or no longer advised.

Passing looks like: No known-bad IAM policies.

How to fix it

Detach and remove the deprecated policy from all principals, then attach a current replacement policy.

AWS CLI

aws iam detach-user-policy --user-name USER --policy-arn ARN

For a role:

aws iam detach-role-policy --role-name ROLE --policy-arn ARN

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Policies → find policy → Attached entities → Detach.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to Deprecated or flawed AWS managed policy in use
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.8.2 Privileged access rights

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks