Description

Detects AWS IAM users that have policies directly attached to them. Direct policy attachments to users make access management more difficult to audit and maintain, increasing security risks. AWS recommends managing permissions through groups instead of attaching policies directly to users.

Detection Strategy

• Scans all IAM users in the AWS account

• For each user, checks if there are any policies directly attached to the user

• Reports a vulnerability if any user has one or more policies directly attached to them

• Identifies the specific user ARN and attached policies in the vulnerability report