Evaluates whether a RAM user has a policy that meets the specified conditions, including policies inherited from a user group.
Scenarios
Enforce least-privilege access for RAM users to reduce security risks.
Risk level
Default risk level: medium.
You can change the risk level based on your business requirements when you apply this rule.
Compliance evaluation logic
- If the RAM user has a policy that meets the specified conditions, including policies inherited from a user group, the evaluation result is Compliant.
- If the RAM user does not have policies that meet the specified conditions, the evaluation result is Incompliant. To remediate an incompliant configuration, see the "Incompliance remediation" section of this topic.
Rule details
| Item | Description |
| Rule name | ram-user-has-specified-policy |
| Rule identifier | ram-user-has-specified-policy |
| Tag | RAM and Policy |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | RAM user |
| Input parameter |
|
Incompliance remediation
Attach policies that meet the specified conditions to the RAM user. For more information, see Modify a custom policy.