The following table shows a list of Customer created IAM Policies that are currently used in the account - both Managed Policies and Inline Policies. If the policy is an inline policy, the table indicates the IAM Principal that the inline policy is associated with.

If the policy contains IAM Actions - or combinations of actions - that fall under certain risk categories - Infrastructure Modification, Privilege Escalation, Resource Exposure, or Data Exfiltration - then the number of occurrences per-policy and per-risk is included in the table.

If the IAM principal is a Role and is assumable by a Compute Service - ec2, ecs-tasks, lambda, or eks - then that is indicated in the table as well.

Each of the aforementioned attributes can be used to prioritize which risks to address first. For more information, see the Prioritization Guidance and Triaging Considerations. Consider using all of the Guidance criteria when reviewing this report as well.

Note that policies or IAM Principals excluded from the scan will not show up in the table at all. Please refer to the Exclusions configuration to see which ones were excluded. To view the list of IAM Principals and their associated policies, see the IAM Principals Tab.


{% for finding in t["results"] %} {% if finding["ManagedBy"] == "Customer" %} {% endif %} {% endfor %}
Inline or Managed Type Policy Name Principal Name Services Count Services Infrastructure Modification Privilege Escalation Resource Exposure Data Exfiltration Compute Role
{% if finding["Type"] == "Policy" %}Managed{% else %}Inline{% endif %} {{ finding["Type"] }} {{ finding['PolicyName'] }} {% if finding["Type"] == "Policy" %}{% else %}{{ finding['Name'] }}{% endif %} {{ finding["ServicesCount"] }} {% for service in finding["Services"] %}{{ service }}{% if not loop.last %}, {% endif %}{% endfor %} {{ finding["ActionsCount"] }} {% if finding["PrivilegeEscalation"]|length > 0 %} {{ finding["PrivilegeEscalation"]|length }} {% endif %} {% if finding["PermissionsManagementActions"]|length>0 %} {{ finding["PermissionsManagementActions"]|length }}{% endif %} {% if finding["DataExfiltrationActions"]|length > 0 %}{{ finding["DataExfiltrationActions"]|length }} {% endif %} {% if finding["AssumableByComputeService"]|length > 0 %}{{ finding["AssumableByComputeService"]|length }} {% endif %}