Description
An IAM group with no users currently grants its group permissions to nobody. It may be awaiting use; confirm its purpose and owner, and remove groups that are no longer needed.
Potential impact
Unused groups and policies complicate permission management. Adding a user to the wrong group later can grant unintended permissions.
Remediation
Remove unnecessary groups. Add only approved users to groups that are needed and review their policies. Do not add a user merely to fill an empty group.
Examples
The examples compare an empty group with a group that has user memberships. Add members only when there is a business need.
Before
hcl
resource "aws_iam_group_membership" "example" {
name = "tf-testing-group-membership"
users = [
]
group = aws_iam_group.example.name
}
resource "aws_iam_group" "example" {
name = "test-group"
}
After
hcl
resource "aws_iam_group_membership" "example" {
name = "tf-testing-group-membership"
users = [
aws_iam_user.user_one.name,
aws_iam_user.user_two.name,
]
group = aws_iam_group.example.name
}
resource "aws_iam_group" "example" {
name = "test-group"
}
resource "aws_iam_user" "user_one" {
name = "test-user"
}
resource "aws_iam_user" "user_two" {
name = "test-user-two"
}