Detects RAM users with directly attached policies instead of inherited permissions.
Scenario
RAM users should inherit permissions from RAM user groups or RAM roles, not receive direct grants. Group- and role-based assignment simplifies permission changes and ensures smooth handover when employees leave.
Risk level
Default risk level: low.
You can change the risk level when you apply this rule.
Evaluation logic
- No policy directly attached to a RAM user: compliant.
- A policy directly attached to a RAM user: non-compliant. Apply the Non-compliance remediation steps to resolve.
Rule details
| Item | Description |
| Rule name | No policies attached directly to RAM users |
| Rule ID | ram-user-no-policy-check |
| Tag | RAM and User |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Time interval | 24 hours |
| Supported resource type | RAM user |
| Input parameter | None |
Non-compliance remediation
Detach the policy from the RAM user. Revoke permissions from a RAM user