Project: KICS (Provisioning / Security & Compliance)
File: 06933df4-0ea7-461c-b9b5-104d27390e0e.md

title: IAM User With No Group hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 06933df4-0ea7-461c-b9b5-104d27390e0e Query name: IAM User With No Group Platform: CloudFormation Severity: <span style="color:#edd57e">Low</span> Category: Access Control URL: A IAM user should belong to a group<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: MyUser: Type: AWS::IAM::User Properties: Path: "/" LoginProfile: Password: myP@ssW0rd Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn Tags: QAUser UserName: TestUser ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="7" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: emptyGroup: Type: AWS::IAM::User Properties: Groups: [] Path: "/" LoginProfile: Password: myP@ssW0rd Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn Tags: QAUser UserName: TestUser ``` ```json title="Positive test num. 3 - json file" hl_lines="5" { "Resources": { "MyUser": { "Type": "AWS::IAM::User", "Properties": { "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ], "Effect": "Allow" }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ], "Tags": [ "QAUser" ], "UserName": "TestUser", "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" } } } }, "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template" } ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="8" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "emptyGroup": { "Type": "AWS::IAM::User", "Properties": { "Groups": [], "Path": "/", "LoginProfile": { "Password": "myP@ssW0rd" }, "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ], "Tags": [ "QAUser" ], "UserName": "TestUser" } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: A sample template Resources: addUserToGroup2: Type: AWS::IAM::User Properties: Groups: QAGroup LoginProfile: Password: myP@ssW0rd Path: "/" Policies: PolicyName: giveaccesstoqueueonly PolicyDocument: Version: '2012-10-17' Statement: Effect: Allow Action: sqs:* Resource: !GetAtt myqueue.Arn Effect: Deny Action: sqs:* NotResource: !GetAtt myqueue.Arn Tags: QAUser UserName: TestUser ``` ```json title="Negative test num. 2 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "A sample template", "Resources": { "addUserToGroup2": { "Type": "AWS::IAM::User", "Properties": { "Groups": [ "QAGroup" ], "LoginProfile": { "Password": "myP@ssW0rd" }, "Path": "/", "Policies": [ { "PolicyName": "giveaccesstoqueueonly", "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sqs:*" ], "Resource": [ "myqueue.Arn" ] }, { "Effect": "Deny", "Action": [ "sqs:*" ], "NotResource": [ "myqueue.Arn" ] } ] } } ], "Tags": [ "QAUser" ], "UserName": "TestUser" } } } } ```