Find IAM Users With Directly Attached Policies

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListUsers",
      "Effect": "Allow",
      "Action": "iam:ListUsers",
      "Resource": "*"
    },
    {
      "Sid": "ReadUserPoliciesAndGroups",
      "Effect": "Allow",
      "Action": [
        "iam:ListAttachedUserPolicies",
        "iam:ListUserPolicies",
        "iam:ListGroupsForUser"
      ],
      "Resource": "arn:aws:iam::111122223333:user/*"
    }
  ]
}

// find-iam-users-with-directly-attached-policies.ts
// Lists IAM users that get permissions from policies attached to the user itself (managed or inline)
// instead of through groups or roles, shows their group memberships, and groups users that share the
// same attached policies so you can see which IAM groups to create. Report-only: it changes nothing.
// Usage: npx tsx find-iam-users-with-directly-attached-policies.ts [--path=/engineering/] [--all]
import {
  IAMClient,
  paginateListUsers,
  paginateListAttachedUserPolicies,
  paginateListUserPolicies,
  paginateListGroupsForUser,
} from "@aws-sdk/client-iam";

const args = process.argv.slice(2);
const pathPrefix = args.find((a) => a.startsWith("--path="))?.split("=")[1] ?? "/";
const showAll = args.includes("--all"); // also list users with no direct policies

type Severity = "HIGH" | "MEDIUM" | "LOW" | "OK";
interface Row {
  User: string;
  Managed: string;
  Inline: string;
  Groups: string;
  LastSignIn: string;
  Severity: Severity;
}

// AWS managed policies that hand over most or all of the account.
const BROAD = new Set(["AdministratorAccess", "PowerUserAccess", "IAMFullAccess"]);
const iam = new IAMClient({});

async function collect<T>(pages: AsyncIterable<T>, pick: (page: T) => string[]): Promise<string[]> {
  const out: string[] = [];
  for await (const page of pages) out.push(...pick(page));
  return out;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  const bySet = new Map<string, string[]>(); // "policyA + policyB" -> users
  let users = 0;

  for await (const page of paginateListUsers({ client: iam }, { PathPrefix: pathPrefix })) {
    for (const user of page.Users ?? []) {
      const name = user.UserName;
      if (!name) continue;
      users++;
      const managed = await collect(paginateListAttachedUserPolicies({ client: iam }, { UserName: name }),
        (p) => (p.AttachedPolicies ?? []).map((a) => a.PolicyName ?? "?"));
      const inline = await collect(paginateListUserPolicies({ client: iam }, { UserName: name }), (p) => p.PolicyNames ?? []);
      const groups = await collect(paginateListGroupsForUser({ client: iam }, { UserName: name }),
        (p) => (p.Groups ?? []).map((g) => g.GroupName ?? "?"));

      const direct = managed.length + inline.length;
      if (!direct && !showAll) continue;
      const severity: Severity = !direct ? "OK" : managed.some((m) => BROAD.has(m)) ? "HIGH" : inline.length ? "MEDIUM" : "LOW";
      rows.push({
        User: name,
        Managed: managed.join(", ") || "-",
        Inline: inline.join(", ") || "-",
        Groups: groups.join(", ") || "(none)",
        LastSignIn: user.PasswordLastUsed ? user.PasswordLastUsed.toISOString().slice(0, 10) : "-",
        Severity: severity,
      });
      if (managed.length) {
        const key = [...managed].sort().join(" + ");
        bySet.set(key, [...(bySet.get(key) ?? []), name]);
      }
    }
  }

  const order: Record<Severity, number> = { HIGH: 0, MEDIUM: 1, LOW: 2, OK: 3 };
  rows.sort((a, b) => order[a.Severity] - order[b.Severity] || a.User.localeCompare(b.User));
  console.table(rows);

  const candidates = [...bySet.entries()].filter(([, names]) => names.length > 1);
  if (candidates.length) {
    console.log("Users sharing the same managed policies (candidates for one IAM group each):");
    for (const [policies, names] of candidates) console.log(`  ${policies}  <-  ${names.join(", ")}`);
  }
  const flagged = rows.filter((r) => r.Severity !== "OK").length;
  console.log(`${users} user(s) read under path ${pathPrefix}; ${flagged} with directly attached policies.`);
  if (flagged) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err instanceof Error ? `${err.name}: ${err.message}` : err);
  process.exit(1);
});

npm install @aws-sdk/client-iam
npm install --save-dev tsx typescript

# Every user with a direct policy
AWS_PROFILE=security-audit npx tsx find-iam-users-with-directly-attached-policies.ts

# One path, and include users without direct policies
AWS_PROFILE=security-audit npx tsx find-iam-users-with-directly-attached-policies.ts --path=/engineering/ --all

┌─────────┬────────────────┬───────────────────────────────────────────────────┬──────────────────┬──────────────┬──────────────┬──────────┐
│ (index) │ User           │ Managed                                           │ Inline           │ Groups       │ LastSignIn   │ Severity │
├─────────┼────────────────┼───────────────────────────────────────────────────┼──────────────────┼──────────────┼──────────────┼──────────┤
│ 0       │ 'ci-legacy'    │ 'AdministratorAccess'                             │ '-'              │ '(none)'     │ '-'          │ 'HIGH'   │
│ 1       │ 'maria.lopez'  │ '-'                                               │ 's3-reports-tmp' │ 'developers' │ '2026-09-25' │ 'MEDIUM' │
│ 2       │ 'backup-agent' │ 'AmazonS3ReadOnlyAccess, AWSBackupOperatorAccess' │ '-'              │ '(none)'     │ '-'          │ 'LOW'    │
│ 3       │ 'etl-runner'   │ 'AmazonS3ReadOnlyAccess, AWSBackupOperatorAccess' │ '-'              │ '(none)'     │ '-'          │ 'LOW'    │
│ 4       │ 'sam.chen'     │ 'ReadOnlyAccess'                                  │ '-'              │ 'developers' │ '2026-09-27' │ 'LOW'    │
└─────────┴────────────────┴───────────────────────────────────────────────────┴──────────────────┴──────────────┴──────────────┴──────────┘
Users sharing the same managed policies (candidates for one IAM group each):
  AWSBackupOperatorAccess + AmazonS3ReadOnlyAccess  <-  backup-agent, etl-runner
42 user(s) read under path /; 5 with directly attached policies.