Attaching IAM policies directly to individual IAM users increases the risk of privilege sprawl, makes permissions harder to audit and revoke, and magnifies impact if a user’s credentials are compromised.
For Ansible amazon.aws.iam_policy or iam_policy tasks, the iam_type property must be set to group or role rather than user. Resources missing the iam_type property or with iam_type set to user are flagged. Attach policies to groups or roles to centralize permission management and enable role-based access patterns.
Secure example (attach policy to a role):
- name:Attach policy to roleamazon.aws.iam_policy:name:my-policypolicy_document:"{{ lookup('file', 'my-policy.json') }}"iam_type:roleiam_name:my-role
Compliant Code Examples
- name:Assign a policy called Admin to the administrators groupamazon.aws.iam_policy:iam_type:groupiam_name:administratorspolicy_name:Adminstate:presentpolicy_document:admin_policy.json
Non-Compliant Code Examples
- name:Assign a policy called Admin to useramazon.aws.iam_policy:iam_type:useriam_name:administratorspolicy_name:Adminstate:presentpolicy_document:admin_policy.json
1
2
rulesets:- Ansible / AWS # Rules to enforce / AWS.
맞춤형 데모 요청
Datadog 시작하기
Ask AI
AI-generated responses may be inaccurate. Verify important info.
