Which compliance frameworks require ensure iam users receive permissions only through groups?

This security check is required by the following compliance frameworks: CIS AWS v1.5.0, CIS AWS v2.0, SOC 2, NIST 800-53.

LOWCIS 1.15

Ensure IAM users receive permissions only through groups

Assigning permissions to groups and adding users to groups simplifies permissions management and makes it easier to audit access. This follows the principle of least privilege.

Security Impact

Direct user policies are harder to audit, maintain, and ensure consistency across the organization.

How to Remediate

Remove inline policies and directly attached policies from users. Create groups with appropriate policies and add users to relevant groups.

Affected Resources

AWS::IAM::UserAWS::IAM::PolicyAWS::IAM::Group

Compliance Frameworks

CIS AWS v1.5.0CIS AWS v2.0SOC 2NIST 800-53

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

Continuous Scanning
Automatically scans all Identity and Access Management (IAM) resources across your AWS accounts every hour
Instant Alerts
Get notified via Slack, email, or webhooks when this misconfiguration is detected
One-Click Remediation
Fix this issue directly from the TigerGate dashboard with our guided remediation
Compliance Evidence
Automatically collect audit evidence for CIS AWS v1.5.0, CIS AWS v2.0, SOC 2 compliance
Drift Detection
Get alerted if this configuration drifts back to an insecure state after remediation