AWS-IAM-Group-Inline-Policies

Severity : Medium

Description: This control ensures that IAM groups are using the managed policies and not using inline policies to control access permissions. AWS well-architect framework recommend not using inline policies as they are not reusable, hard to managed, security risks in delegating permissions and lack fine-grained control over the policies.

Remediation Steps:

Perform following to convert inline policies to managed policies :

Login to the AWS Management Console at https://console.aws.amazon.com.
Navigate to IAM console.
In navigation pane, click User groups.
From the list of groups select the group reported with inline policy.
Select Permissions.
Select the name of the inline policy to remove.
Copy the JSON policy document for the policy.
In navigation, choose Policies.
Select Create policy and then choose the JSON.
Replace the existing text with saved JSON policy text, and choose Review policy.
Enter a name for your policy.
Select Create policy.
In navigation pane, again click User groups. From the list of groups, go back to the group reported with inline policy.
Select Permissions.
Select check box next to new policy, choose Add permissions, and then choose Attach policy.
Choose Next: Review, and then choose Add permissions.
Select check box next to the inline policy to remove and choose Remove.

Important:

Reference: