IAM Group inline policies can give unnecessary permissions to the users within the group, which can result in security risks. To prevent this, it is recommended to ensure that IAM groups have no inline policies attached.
To ensure IAM group has no inline policies, follow the below steps:
- Open the AWS Management Console and navigate to the IAM dashboard.
- In the left navigation pane, select "Groups."
- Select the group for which you want to check for inline policies.
- In the group summary page, click on the "Permissions" tab.
- Review the policies that are listed under "Attached Policies" section. Policies that have the "type" column as "Managed" are managed policies and those with "type" column as "Inline" are inline policies. Remove any inline policies that are not needed by clicking on the "X" icon on the right side of the policy.
- Once all inline policies are removed, click on the "Save Changes" button to update the group permissions.
By ensuring IAM groups have no inline policies, you can reduce the risk of granting unnecessary permissions and make it easier to manage group permissions.
Note: Remediation steps provided by Lightlytics are meant to be suggestions and guidelines only. It is crucial to thoroughly verify and test any remediation steps before applying them to production environments. Each organization's infrastructure and security needs may differ, and blindly applying suggested remediation steps without proper testing could potentially cause unforeseen issues or vulnerabilities. Therefore, it is strongly recommended that you validate and customize any remediation steps to meet your organization's specific requirements and ensure that they align with your security policies and best practices.
