{
  "Provider": "aws",
  "CheckID": "iam_policy_attached_only_to_group_or_roles",
  "CheckTitle": "Ensure IAM policies are attached only to groups or roles",
  "CheckType": ["Software and Configuration Checks", "Industry and Regulatory Standards" ,"CIS AWS Foundations Benchmark"],
  "ServiceName": "iam",
  "SubServiceName": "",
  "ResourceIdTemplate": "arn:partition:service:region:account-id:resource-id",
  "Severity": "low",
  "ResourceType": "AwsIamUser",
  "Description": "Ensure IAM policies are attached only to groups or roles",
  "Risk": "By default IAM users; groups; and roles have no access to AWS resources. IAM policies are the means by which privileges are granted to users; groups; or roles. It is recommended that IAM policies be applied directly to groups and roles but not users. Assigning privileges at the group or role level reduces the complexity of access management as the number of users grow. Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.",
  "RelatedUrl": "",
  "Remediation": {
    "Code": {
      "CLI": "",
      "NativeIaC": "",
      "Other": "",
      "Terraform": ""
    },
    "Recommendation": {
      "Text": "Remove any policy attached directly to the user. Use groups or roles instead.",
      "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html"
    }
  },
  "Categories": [],
  "Tags": {
    "Tag1Key": "value",
    "Tag2Key": "value"
  },
  "DependsOn": [],
  "RelatedTo": [],
  "Notes": "CAF Security Epic: IAM",
  "Compliance": [
    {
      "Control": [
        "1.16"
      ],
      "Framework": "CIS-AWS",
      "Group": [
        "level1"
      ],
      "Version": "1.4"
    }
  ]
}
