IAM users should not have inline policies attached

What it checks

Inline policy is attached directly to an IAM user.

Where it applies

Terraform: aws_iam_user_policy

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Create a customer managed policy from the exact inline document and attach it to a group the user belongs to (aws_iam_group_policy_attachment), or move the workload to a role-based pattern. A managed policy is limited to 6,144 characters (whitespace excluded), and a group holds at most 10 managed policies; merge or split documents to fit.
2. Verify the user's effective permissions through the group, and only then delete the inline policy. Keep the inline policy until verification succeeds.

Frameworks

• AWS FSBP IAM.2
• SOC 2 CC6.1
• SOC 2 CC6.3
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules