IAM group should be used for permission management

Low AWS General aws-iam-group-iam-group-used-permission

Applies to

AWS::IAM::Group

What CGPulse checks

A resource passes this rule when groupName must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Use IAM groups for permissions and assign policies to groups rather than individual users. In AWS Console: IAM > User groups > create group > attach policies. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html

Terraform

resource "aws_iam_group" "{name}" {
  name = "{name}"
}

Compliance frameworks

Cloud Security: AWS Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.308(a)(4)
ISO 27001: Information SecurityA.9.2.3
NIST 800-53: Cloud Security ControlsAC-3
PCI DSS v4.07.2.2
SOC 2: Trust ServicesCC6.3

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan