Receive Permissions via IAM Groups Only

01 Sign in to the AWS Management Console.

02 Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

03 In the navigation panel, under Access management, choose Users.

04 Click on the name of the IAM user that you want to examine.

05 Select the Permissions tab to view the identity-based policies attached directly to the selected IAM user.

06 In the Permissions policies section, check for any managed and/or inline policies attached to the selected IAM user. If one or more identity-based policies are attached to the user, the selected Amazon IAM user does not receive access permissions through IAM groups only.

07 Repeat steps no. 4 – 6 for each IAM user that you want to examine, available within your AWS cloud account.

01 Run list-users command (OSX/Linux/UNIX) using custom query filters to list the names of all IAM users available in your AWS account:

aws iam list-users
  --output table
  --query 'Users[*].UserName'

02 The command output should return a table with the requested IAM user identifiers:

------------------------
|      ListUsers       |
+----------------------+
|  cc-aws-ec2-manager  |
|  cc-project5-admin   |
+----------------------+

03 Run list-attached-user-policies command (OSX/Linux/UNIX) using the name of the Amazon IAM user that you want to examine as the identifier parameter and custom filtering to list the name of each managed policy attached to the selected IAM user:

aws iam list-attached-user-policies
  --user-name cc-aws-ec2-manager
  --output table
  --query 'AttachedPolicies[*].PolicyName'

04 The command output should return a table with the requested IAM managed policy name(s):

--------------------------------
|   ListAttachedUserPolicies   |
+------------------------------+
|  AmazonEC2FullAccess         |
|  CloudWatchAgentAdminPolicy  |
+------------------------------+

05 Run list-user-policies command (OSX/Linux/UNIX) using the name of the Amazon IAM user that you want to examine as the identifier parameter and custom query filters to list the name of each inline policy associated with the selected IAM user:

aws iam list-user-policies
  --user-name cc-aws-ec2-manager
  --output table
  --query 'PolicyNames'

06 The command output should return a table with the requested inline IAM policy name(s):

----------------------------------
|        ListUserPolicies        |
+--------------------------------+
|  cc-ec2-access-inline-policy   |
|  cc-ec2-manager-inline-policy  |
+--------------------------------+

07 If the selected Amazon IAM user is associated with one or more managed policies (as shown at step no. 4) and/or inline policies (as shown at step no. 6), the IAM user has one or more identity-based policies attached, therefore the selected user does not receive access permissions through IAM groups only.

08 Repeat steps no. 3 – 7 for each IAM user that you want to examine, available in your AWS cloud account.

01 CloudFormation template (JSON):

1. Step 1: Remove the associated policy from your IAM user:
   {
   	"AWSTemplateFormatVersion": "2010-09-09",
   	"Description": "Remove policy from Amazon IAM user",
   	"Resources": {
   		"IAMUser": {
   			"Type": "AWS::IAM::User",
   			"Properties": {
   				"UserName": "cc-database-manager"
   			}
   		},
   		"IAMUserPolicy": {
   			"Type": "AWS::IAM::Policy",
   			"Properties": {
   				"PolicyName": "cc-rds-full-access",
   				"PolicyDocument": {
   					"Version": "2012-10-17",
   					"Statement": [
   						{
   							"Effect": "Allow",
   							"Action": "rds:*",
   							"Resource": "*"
   						}
   					]
   				},
   				"Users": [ { "Ref": "IAMUser" } ]
   			}
   		}
   	}
   }
   

2. Step 2: Attach the policy removed from your IAM user to the new IAM group, and add your IAM user to this group:
   {
   	"AWSTemplateFormatVersion": "2010-09-09",
   	"Resources": {
   		"IAMGroup": {
   			"Type": "AWS::IAM::Group",
   			"Properties": {
   				"GroupName": "cc-database-admin-group"
   			}
   		},
   		"IAMUser": {
   			"Type": "AWS::IAM::User",
   			"Properties": {
   				"UserName": "cc-database-manager"
   			}
   		},
   		"IAMGroupPolicy": {
   			"Type": "AWS::IAM::Policy",
   			"Properties": {
   				"PolicyName": "cc-rds-full-access",
   				"PolicyDocument": {
   					"Version": "2012-10-17",
   					"Statement": [
   						{
   							"Effect": "Allow",
   							"Action": "rds:*",
   							"Resource": "*"
   						}
   					]
   				},
   				"Groups": [
   					{
   						"Ref": "IAMGroup"
   					}
   				]
   			}
   		},
   		"AddUserToGroup": {
   			"Type": "AWS::IAM::UserToGroupAddition",
   			"Properties": {
   				"GroupName": {
   					"Ref": "IAMGroup"
   				},
   				"Users": [
   					{
   						"Ref": "IAMUser"
   					}
   				]
   			}
   		}
   	}
   }
   

02 CloudFormation template (YAML):

1. Step 1: Remove the associated policy from your IAM user:
   AWSTemplateFormatVersion: '2010-09-09'
   	Description: Remove policy from Amazon IAM user
   	Resources:
   	IAMUser:
   		Type: AWS::IAM::User
   		Properties:
   		UserName: cc-database-manager
   	IAMUserPolicy:
   		Type: AWS::IAM::Policy
   		Properties:
   		PolicyName: cc-rds-full-access
   		PolicyDocument:
   			Version: '2012-10-17'
   			Statement: 
   			- Effect: Allow
   			Action: 'rds:*'
   			Resource: '*'
   		Users:
   		- Ref: IAMUser
   

2. Step 2: Attach the policy removed from your IAM user to the new IAM group, and add your IAM user to this group:
   AWSTemplateFormatVersion: '2010-09-09'
   	Resources:
   	IAMGroup:
   		Type: AWS::IAM::Group
   		Properties:
   		GroupName: cc-database-admin-group
   	IAMUser:
   		Type: AWS::IAM::User
   		Properties:
   		UserName: cc-database-manager
   	IAMGroupPolicy:
   		Type: AWS::IAM::Policy
   		Properties:
   		PolicyName: cc-rds-full-access
   		PolicyDocument:
   			Version: '2012-10-17'
   			Statement:
   			- Effect: Allow
   				Action: 'rds:*'
   				Resource: '*'
   		Groups:
   			- !Ref 'IAMGroup'
   	AddUserToGroup:
   		Type: AWS::IAM::UserToGroupAddition
   		Properties:
   		GroupName: !Ref 'IAMGroup'
   		Users:
   			- !Ref 'IAMUser'
   

01 Terraform configuration file (.tf):

1. Step 1: Remove the associated policy from your IAM user:
   terraform destroy -target aws_iam_policy.cc-rds-full-access
   

2. Step 2: Attach the policy removed from your IAM user to the new IAM group, and add your IAM user to this group:
   terraform {
   	required_providers {
   		aws = {
   			source  = "hashicorp/aws"
   			version = "~> 4.0"
   		}
   	}
   	required_version = ">= 0.14.9"
   }
   
   provider "aws" {
   	profile = "default"
   	region  = "us-east-1"
   }
   
   resource "aws_iam_user" "iam-user" {
   	name = "cc-database-manager"
   }
   
   resource "aws_iam_policy" "iam-policy" {
   	name = "cc-rds-full-access"
   	policy = <<EOF
   	{
   		"Version": "2012-10-17",
   		"Statement": [
   			{
   				"Effect": "Allow",
   				"Action": "rds:*",
   				"Resource": "*"
   			}
   		]
   	}
   	EOF
   }
   
   resource "aws_iam_group" "iam-group" {
   	name = "cc-database-admin-group"
   }
   
   resource "aws_iam_policy_attachment" "iam-group-attachment" {
   	name       = "iam-group-attachment"
   	groups     = [aws_iam_group.iam-group.name]
   	policy_arn = aws_iam_policy.iam-policy.arn
   }
   
   resource "aws_iam_user_group_membership" "iam-user-group-membership" {
   	user = aws_iam_user.iam-user.name
   	groups = [
   		aws_iam_group.iam-group.name
   	]
   }
   

01 Sign in to the AWS Management Console.

02 Navigate to Amazon IAM console at https://console.aws.amazon.com/iam/.

03 In the navigation panel, under Access management, choose User groups.

04 Click on the Create group button from the console top menu to initiate the IAM group setup.

05 On the Create user group setup page, perform the following operations:

1. Enter a unique name for your new IAM group in the User group name box.
2. For Attach permissions policies – Optional, select the permissions policies required to provide access to the group members. Follow the Principle of Least Privilege (POLP) and give the group members the minimal amount of access required to perform their tasks. You can configure permissions that relate to job functions such as administrators, developers, and testers, and add users to the group as needed. All the IAM users added to this group (i.e. group members) will inherit the permissions assigned to the group at this step.
3. Choose Create group to create your new IAM group.

06 Click on the name of the newly created Amazon IAM group.

07 Select the Users tab and choose Add users.

08 Select the IAM user(s) that you want to add to your new group. Choose Add users to save the changes.

09 In the navigation panel, under Access management, choose Users.

10 Click on the name of the user added to the new IAM group at step no. 8.

11 Select the Permissions tab to view the identity-based policies attached to the selected IAM user.

12 Perform the following actions to detach the identity-based policies from the selected user:

1. In the Permissions policies section, under Attached directly, detach each managed/inline policy from the selected IAM user by clicking the x (detach) icon.
2. Inside the Detach policy confirmation box, choose Detach to confirm the action.

13 Repeat steps no. 10 – 12 for each user assigned to the IAM group created at step no. 5.

01 Run create-group command (OSX/Linux/UNIX) to create a new IAM group for your users:

aws iam create-group
  --group-name cc-ec2-admins-group

02 The command output should return the metadata available for the new IAM group:

[
	{
		"Path": "/",
		"CreateDate": "2021-08-11T10:00:00Z",
		"GroupId": "AAAABBBBCCCCDDDDEEEEF",
		"Arn": "arn:aws:iam::123456789012:group/cc-ec2-admins-group",
		"GroupName": "cc-ec2-admins-group"
	}
]  

03 Run attach-group-policy command (OSX/Linux/UNIX) to attach the permissions policies required to provide access to the group members. Follow the Principle of Least Privilege and give the group members the minimal amount of access required to perform their tasks. You can configure permissions that relate to job functions such as administrators, developers, and accounting, and add users to the group as needed. All the group members will inherit the permissions assigned to the IAM group at this step (the command does not produce an output):

aws iam attach-group-policy
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess
  --group-name cc-ec2-admins-group

04 Run add-user-to-group command (OSX/Linux/UNIX) to add the specified IAM user to your new Amazon IAM group. The user will automatically inherit the IAM group policies:

aws iam add-user-to-group
  --user-name cc-aws-ec2-manager
  --group-name cc-ec2-admins-group

05 To remove any managed policies attached directly to the IAM user added to the new group at the previous step, run detach-user-policy command (OSX/Linux/UNIX) using the policy ARN as the identified parameter (the command does not produce an output):

aws iam detach-user-policy
  --user-name cc-aws-ec2-manager
  --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess

06 To remove any inline policies from the new IAM group member, run delete-user-policy command (OSX/Linux/UNIX) using the policy name as the identified parameter (the command does not produce an output):

aws iam delete-user-policy
  --user-name cc-aws-ec2-manager
  --policy-name cc-ec2-access-inline-policy

07 Repeat steps no. 5 and 6 for each user assigned to the IAM group created at step no. 1.