Control: IAM AWS managed policies should be attached to IAM role
Description
This control checks if all AWS managed policies specified in the list of managed policies are attached to the AWS Identity and Access Management (IAM) role. The rule is non-compliant if an AWS managed policy is not attached to the IAM role.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.iam_managed_policy_attached_to_roleSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.iam_managed_policy_attached_to_role --shareSQL
This control uses a named query:
with role_attached_policies as ( select jsonb_array_elements_text(attached_policy_arns) as policy_arn from aws_iam_role)select arn as resource, case when arn in (select policy_arn from role_attached_policies) then 'ok' else 'alarm' end as status, case when arn in (select policy_arn from role_attached_policies) then title || ' attached to IAM role.' else title || ' not attached to IAM role.' end as reason , account_idfrom aws_iam_policywhere is_aws_managed;