> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Principals with inline policies remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        None

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of principals with inline policies in AWS IAM using AWS CLI, follow these steps:

        1. Identify the principals with inline policies:
           * Run the following AWS CLI command to list all IAM users with inline policies:
             ```
             aws iam list-users --query 'Users[?not_null(UserPolicyList)].[UserName, UserPolicyList[?PolicyName].PolicyName]' --output table
             ```
           * Run the following AWS CLI command to list all IAM roles with inline policies:
             ```
             aws iam list-roles --query 'Roles[?not_null(RolePolicyList)].[RoleName, RolePolicyList[?PolicyName].PolicyName]' --output table
             ```

        2. Create managed policies for the inline policies:
           * For each IAM user with inline policies, create a managed policy using the following AWS CLI command:
             ```
             aws iam create-policy --policy-name <policy-name> --policy-document file://<policy-document.json>
             ```
             Replace `<policy-name>` with a suitable name for the policy and `<policy-document.json>` with the JSON document containing the inline policy.
           * For each IAM role with inline policies, create a managed policy using the same AWS CLI command.

        3. Attach the managed policies to the principals:
           * For each IAM user, attach the managed policy using the following AWS CLI command:
             ```
             aws iam attach-user-policy --user-name <user-name> --policy-arn <policy-arn>
             ```
             Replace `<user-name>` with the IAM user's name and `<policy-arn>` with the ARN of the managed policy.
           * For each IAM role, attach the managed policy using the same AWS CLI command.

        4. Verify the remediation:
           * Run the following AWS CLI command to list all IAM users and their associated managed policies:
             ```
             aws iam list-users --query 'Users[].[UserName,join(`, `,UserPolicyList[?PolicyName].PolicyName)]' --output table
             ```
           * Run the following AWS CLI command to list all IAM roles and their associated managed policies:
             ```
             aws iam list-roles --query 'Roles[].[RoleName,join(`, `,RolePolicyList[?PolicyName].PolicyName)]' --output table
             ```

        By following these steps, you will remediate the misconfiguration of principals with inline policies in AWS IAM using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of principals with inline policies in AWS IAM using Python, follow these steps:

        1. Identify the principals with inline policies:
           * Use the AWS Identity and Access Management (IAM) service to list all the IAM users, groups, and roles.
           * For each principal, check if they have any inline policies attached.

        2. Create managed policies:
           * Analyze the inline policies and identify their permissions and resources.
           * Create managed policies in AWS IAM using the `boto3` Python library.
           * Assign the appropriate permissions and resources to the managed policies.

        3. Detach inline policies:
           * For each principal with inline policies, use the `boto3` library to detach the inline policies.
           * Keep track of the detached inline policies to later attach them as managed policies.

        4. Attach managed policies:
           * For each principal, attach the corresponding managed policies created in step 2 using the `boto3` library.
           * Ensure that the managed policies provide the necessary permissions and resources required by the principals.

        5. Update your code or infrastructure-as-code templates:
           * If you have any code or infrastructure-as-code templates that reference the inline policies, update them to use the managed policies instead.
           * Replace the inline policy references with the corresponding managed policy ARNs.

        6. Test and validate:
           * Test the remediated IAM configurations thoroughly to ensure that the intended permissions and resources are still accessible.
           * Validate the permissions and resources for each principal to ensure they align with the desired access levels.

        7. Monitor and enforce best practices:
           * Regularly monitor your AWS IAM configurations to identify any new instances of principals with inline policies.
           * Enforce best practices by using managed policies instead of inline policies wherever possible.

        By following these steps, you can successfully remediate the misconfiguration of principals with inline policies in AWS IAM using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_iam_user" "example" {
          name = "IAM_USER_NAME" # replace with the IAM user name
        }

        # New reusable managed policy that replaces the old inline policy JSON
        resource "aws_iam_policy" "user_permissions" {
          name        = "IAM_MANAGED_POLICY_NAME" # e.g. "app-user-permissions"
          description = "Managed policy replacing inline policy on IAM user IAM_USER_NAME"

          policy = jsonencode({
            Version = "2012-10-17"
            Statement = [
              # Copy the statements from the existing inline policy here
              {
                Sid      = "STATEMENT_ID"
                Effect   = "Allow"
                Action   = [
                  "SERVICE:ACTION_1",
                  "SERVICE:ACTION_2",
                ]
                Resource = "*"
              }
            ]
          })
        }

        # Attach the managed policy to the IAM user
        resource "aws_iam_user_policy_attachment" "user_attachment" {
          user       = aws_iam_user.example.name
          policy_arn = aws_iam_policy.user_permissions.arn
        }

        # (Existing inline policy to be removed from Terraform)
        # Delete or comment out any aws_iam_user_policy resources for this user,
        # e.g.:
        #
        # resource "aws_iam_user_policy" "inline" {
        #   user   = aws_iam_user.example.name
        #   policy = jsonencode({ ... }) # REMOVE this resource to eliminate inline policy
        # }
        ```

        This change does not force replacement of the IAM user itself; it destroys the inline policy resource and creates a managed policy plus an attachment.

        For verification, `terraform plan` should show:

        * `aws_iam_user_policy` resources for that user being destroyed.
        * A new `aws_iam_policy` being created.
        * A new `aws_iam_user_policy_attachment` being created.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>