Description
An IAM user without group membership may require separate per-user permission management. Absence of a group does not itself grant permissions or expose the account publicly.
Potential impact
Growing individual exceptions can lead to missed permissions during review or revocation.
Remediation
Add users who need shared permissions to appropriate Groups, and review group policies and membership together. Do not grant unnecessary group permissions.
Examples
These excerpts add group membership. Prepare QAGroup, myqueue, and the password value in the ConsolePassword secret separately; review whether the remaining direct policy should also be migrated.
Before
yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: Group membership comparison
Resources:
MyUser:
Type: AWS::IAM::User
Properties:
Path: "/"
LoginProfile:
Password: '{{resolve:secretsmanager:ConsolePassword:SecretString:password}}'
Policies:
- PolicyName: giveaccesstoqueueonly
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sqs:*
Resource:
- !GetAtt myqueue.Arn
- Effect: Deny
Action:
- sqs:*
NotResource:
- !GetAtt myqueue.Arn
Tags:
- Key: Name
Value: QAUser
UserName: TestUser
After
yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: Group membership comparison
Resources:
addUserToGroup2:
Type: AWS::IAM::User
Properties:
Groups:
- QAGroup
LoginProfile:
Password: '{{resolve:secretsmanager:ConsolePassword:SecretString:password}}'
Path: "/"
Policies:
- PolicyName: giveaccesstoqueueonly
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sqs:*
Resource:
- !GetAtt myqueue.Arn
- Effect: Deny
Action:
- sqs:*
NotResource:
- !GetAtt myqueue.Arn
Tags:
- Key: Name
Value: QAUser
UserName: TestUser