The following table shows a list of Customer created IAM Policies that are currently used in the account - both Managed Policies and Inline Policies. If the policy is an inline policy, the table indicates the IAM Principal that the inline policy is associated with. It only includes policies that (1) have findings and (2) are currently used in the account.

If the policy contains IAM Actions - or combinations of actions - that fall under certain risk categories - Privilege Escalation, Resource Exposure, Infrastructure Modification, and Data Exfiltration - then the number of occurrences per-policy and per-risk is included in the table. If there are no findings for a particular policy, or if the policy is not attached to any IAM Principals, then the policy is not included in the findings.

If the IAM principal is a Role and is assumable by a Compute Service - ec2, ecs-tasks, lambda, or eks - then that is indicated in the table as well.

Each of the aforementioned attributes can be used to prioritize which risks to address first. For more information, see the Prioritization Guidance and Triaging Considerations. Consider using all of the Guidance criteria when reviewing this report as well.

Note that policies or IAM Principals excluded from the scan will not show up in the table at all. Please refer to the Exclusions configuration to see which ones were excluded. To view the list of IAM Principals and their associated policies, see the IAM Principals Tab.


{% for finding in t["results"] %} {% if finding["ManagedBy"] == "Customer" %} {% endif %} {% endfor %}
Type Policy Name Principal Name Services Count Services Infrastructure Modification Privilege Escalation Resource Exposure Data Exfiltration Compute Role
{% if finding["Type"] == "Policy" %}{{ finding["ManagedBy"] }}-Managed {{ finding["Type"] }}{% else %}Inline {{ finding["Type"] }} Policy{% endif %} {{ finding['PolicyName'] }} {% if finding["Type"] == "Policy" %}{% else %}{{ finding['Name'] }}{% endif %} {{ finding["ServicesCount"] }}

{% for service in finding["Services"] %}{{ service }}{% if not loop.last %}, {% endif %}{% endfor %}

{{ finding["ActionsCount"] }} {% if finding["PrivilegeEscalation"]|length > 0 %} {{ finding["PrivilegeEscalation"]|length }} {% endif %} {% if finding["PermissionsManagementActions"]|length>0 %} {{ finding["PermissionsManagementActions"]|length }}{% endif %} {% if finding["DataExfiltrationActions"]|length > 0 %}{{ finding["DataExfiltrationActions"]|length }} {% endif %} {% if finding["AssumableByComputeService"]|length > 0 %}{{ finding["AssumableByComputeService"]|length }} {% endif %}