IAM role or user is missing a permissions boundary

What it checks

IAM role or user is missing a permissions boundary

Where it applies

Terraform: aws_iam_role, aws_iam_user

CloudFormation: AWS::IAM::Role, AWS::IAM::User

How to fix it

1. Define a boundary policy that caps permissions granted by identity-based policies attached to this role/user. Attach it via permissions_boundary. A boundary does not grant permissions by itself; explicit denies in applicable policies still override grants.

Frameworks

• SOC 2 CC6.1
• NIST 800-53 rev5 AC-3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules