cis-aws-foundations-2-13

name	cis-aws-foundations-2.13
description	Ensure IAM users receive permissions only through groups
category	cis-iam
version	7.0.0
author	cyberstrike-official
tags	["cis","aws","iam","groups","permissions","policies","least-privilege"]
cis_id	2.13
cis_benchmark	CIS AWS Foundations Benchmark v7.0.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-foundations-2.14","cis-aws-foundations-2.15"]
prerequisites	[]
severity_boost	{}

Ensure IAM users receive permissions only through groups

Description

IAM users are granted access to services, functions, and data through IAM policies. There are four ways to assign policies to a user:

1. Attach an inline (user) policy directly to the user
2. Attach a managed policy directly to the user
3. Add the user to an IAM group with attached policies
4. Add the user to an IAM group with inline policies

Only assigning permissions through IAM groups is recommended.

Rationale

Assigning IAM policies through groups centralizes permissions management and aligns access with organizational roles. This reduces complexity and lowers the likelihood of excessive or inconsistent permissions.

Impact

Directly assigning policies to users increases the risk of misconfigured or excessive permissions and makes access management more difficult to audit and maintain.

Audit Procedure

Using AWS CLI

1. Run the following command to list all IAM users:

aws iam list-users --query 'Users[*].UserName' --output text

2. For each user returned, run:

aws iam list-attached-user-policies --user-name <user-name>
aws iam list-user-policies --user-name <user-name>

3. If any policies are returned, the user has either:

• A directly attached managed policy, or
• An inline policy

Expected Result

For each IAM user, both list-attached-user-policies and list-user-policies should return empty results. All permissions should be assigned through IAM groups only.

Remediation

Using AWS Console

Create and configure a group:

1. Sign in to the AWS Management Console and open the IAM console (https://console.aws.amazon.com/iam/)
2. In the navigation pane, click User Groups and then click Create Group
3. Enter a group name and click Next
4. Select the appropriate policies
5. Click Create Group

Add users to the group:

6. Navigate to User Groups
7. Select the group
8. Click Add users to group