IAM user has policies attached directly instead of through a group

Severity: Low
Service: IAM
Check ID: IAM_USER_HAS_DIRECT_POLICY

What this check finds

Attaching policies directly to users bypasses the principle of role-based access management and makes permission audits error-prone. Policies should be attached to groups or roles, and users assigned to those groups. CIS v5.0 §1.14.

Passing looks like: IAM users get permissions via groups.

How to fix it

Move the user into an appropriate IAM group that has the required policies, then detach all directly attached policies.

AWS CLI

aws iam add-user-to-group --user-name USERNAME --group-name GROUP_NAME

Then detach each direct policy:

aws iam detach-user-policy --user-name USERNAME --policy-arn POLICY_ARN

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Users → select user → Permissions → Attached directly → detach each policy.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM user has policies attached directly instead of through a group
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	1.14 Ensure IAM users receive permissions only through groups
PCI-DSS v4.0.1	7.2 Access to system components and data is appropriately defined and assigned
HIPAA Security Rule	164.308(a)(3) Workforce Security — Access Authorization 164.308(a)(4) Information Access Management
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.8.2 Privileged access rights A.8.3 Information access restriction

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks