Ensure IAM Users Receive Permissions Only Through Groups Rule

Ensure IAM Users Receive Permissions Only Through Groups for cis_v130

Description

Troubleshooting Steps

2. 1.

   List Users with Direct Permissions:

   • Use the AWS Management Console or AWS CLI to identify any IAM users with inline policies or attached managed policies that are not delivered through groups.
4. 2.

   Review User Policies:

   • Review the identified IAM user's policies to understand the permissions granted.
6. 3.

   Create or Identify Appropriate IAM Groups:

   • Determine suitable groups for the users based on their functional roles within the organization.
8. 4.

   Recreate Permissions in the Groups:

   • Create similar permissions to those found in the individual user policies within the respective groups.
10. 5.

    Attach Users to Their Relevant Groups:

    • Add the users to the groups so that they inherit the necessary permissions.
12. 6.

    Remove Directly Attached Policies:

    • Once IAM users are part of the appropriate groups, remove the directly attached user policies.

Necessary AWS CLI Commands

2. 1.

   List IAM Users with Attached Policies:

   aws iam list-users | \
   awk '/UserName/{print $2}' | \
   xargs -I {} aws iam list-attached-user-policies --user-name {} | \
   grep PolicyArn
   

   This command sequence lists all users with their attached policy ARNs.

4. 2.

   Create IAM Group with Required Permissions:

   aws iam create-group --group-name YourGroupName
   

   Replace

   YourGroupName

   with the desired name for the IAM group that will contain the appropriate permissions.

6. 3.

   Attach Policy to Group:

   aws iam attach-group-policy --group-name YourGroupName --policy-arn arn:aws:iam::aws:policy/PolicyName
   

   Replace

   YourGroupName

   with your group's name and

   PolicyName

   with the relevant policy to attach to the group.

8. 4.

   Add User to Group:

   aws iam add-user-to-group --group-name YourGroupName --user-name UserName
   

   Replace

   YourGroupName

   with the group's name and

   UserName

   with the user's name.

10. 5.

    Detach Directly Attached User Policies:

    aws iam detach-user-policy --user-name UserName --policy-arn arn:aws:iam::aws:policy/PolicyName
    

    Replace

    UserName

    with the user's name and

    PolicyName

    with the policy to be detached from the user.

12. 6.

    Remove Inline Policies:

    aws iam delete-user-policy --user-name UserName --policy-name InlinePolicyName
    

    Replace

    UserName

    with the user's name and

    InlinePolicyName

    with the inline policy to be removed.

Step by Step Guide for Remediation

2. 1.

   Audit Current IAM Users and Policies: Utilize the necessary AWS CLI commands to list all users with their attached policies.

4. 2.

   Group Creation and Configuration: Identify the required roles and permissions, then create IAM groups aligning with each set of responsibilities.

6. 3.

   Policy Attachment: Attach the relevant policies to the newly created IAM groups, ensuring they replicate the permissions formerly assigned directly to users.

8. 4.

   User Group Association: Add IAM users to their respective newly created groups to provide them with the necessary permissions.

10. 5.

    Remove Direct Assignments: Detach any directly attached policies from the users and remove any inline policies, leaving the users with permissions solely from their group memberships.