AWS_IAM_51
It is recommended that IAM policies be applied directly to groups and roles but not to users. IAM policies are the means by which privileges are granted to users, groups, or roles. By default, IAM users, groups, and roles have no access to AWS resources.
Assigning privileges at the group or role level reduces the complexity of access management as the number of users grow. Reducing access management complexity may in-turn reduce opportunity for a principal to inadvertently receive or retain excessive privileges.
From Portal:
To remove a direct association between a user and policy:
1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the left navigation pane, click on Users
3. For each user:
a. Select the user
b. Click on the Permissions tab
c. Expand Managed Policies
d. Click Detach Policy for each policy
e. Expand Inline Policies
f. Click Remove Policy for each policy
To create an IAM group and assign a policy to it:
1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/
2. In the navigation pane, click Groups and then click Create New Group .
3. In the Group Name box, type the name of the group and then click Next Step .
4. In the list of policies, select the check box for each policy that you want to apply to all members of the group. Then click Next Step.
5. Click Create Group
To add a user to a given group:
1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane, click Groups
3. Select the group to add a user to
4. Click Add Users To Group
5. Select the users to be added to the group
6. Click Add Users
From TF:
To add user to a group, add following:
resource “aws_iam_group_membership” “add_user_to_group_example” {
users = [
USER-1-NAME,
USER-2-NAME,
]
group = GROUP-NAME
}
From Command Line:
To remove the specified managed policy from a specified user, run:
aws iam detach-user-policy –user-name USER-NAME –policy-arn POLICY-ARN
To attach a policy to IAM group, run:
aws iam attach-group-policy –group-name GROUP-NAME –policy-arn POLICY-ARN
To add a user to a group, run:
aws iam add-user-to-group –group-name GROUP-NAME –user-name USER-NAME
References:
1. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_create.html
2. https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage_add-remove-users.html
3. https://docs.aws.amazon.com/cli/latest/reference/iam/add-user-to-group.html
4.https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership
Want to Know More?
Learn how our partners are managing their cloud security and compliance with Cloudlytics.
I hereby accept the GDPR and Privacy Policy, by subscribing to the newsletters.
