> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_attached_policy.md).

# AWS\_ATTACHED\_POLICY

## Summary

|                                |                                                                                                                             |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------- |
| **FSProtect ACL Alias**        | AWS\_ATTACHED\_POLICY                                                                                                       |
| **Edge Type**                  | Relationship                                                                                                                |
| **Affected Object Types**      | IAM Users, IAM Groups, IAM Roles, Customer Managed Policies, AWS Managed Policies                                           |
| **Exploitation Certainty**     | Certain                                                                                                                     |
| **AWS IAM Action / Condition** | Relationship visibility via `iam:ListAttachedUserPolicies`, `iam:ListAttachedGroupPolicies`, `iam:ListAttachedRolePolicies` |

## Description

`AWS_ATTACHED_POLICY` represents that a managed IAM policy is attached to a user, group, or role.

This edge is a relationship, not an action by itself. Its security impact depends on what permissions are granted by the attached policy. It is essential for graphing effective permissions and attack paths because attached managed policies are a primary inheritance mechanism in IAM.

## Identification

### AWS CLI

List policies attached to a user:

```bash
aws iam list-attached-user-policies --user-name TargetUser
```

List policies attached to a group:

```bash
aws iam list-attached-group-policies --group-name TargetGroup
```

List policies attached to a role:

```bash
aws iam list-attached-role-policies --role-name TargetRole
```

### AWS Console

* Open **IAM**.
* For **Users**, **Groups**, or **Roles**, open the target identity.
* Open the **Permissions** tab and review **Managed policies** attached.

## Exploitation

There is no direct exploit path for this edge. `AWS_ATTACHED_POLICY` shows a permission relationship.

Abuse potential depends on the content of the attached policy and whether the attacker can alter attachments or policy versions.

## Mitigation

* Minimize use of broad managed policies (for example full-admin policies).
* Use least privilege managed policies and periodic access reviews.
* Remove unnecessary policy attachments from users, groups, and roles.
* Prefer role-based access patterns over direct user policy attachment.

## Detection

Monitor attachment changes in CloudTrail:

* `AttachUserPolicy`, `DetachUserPolicy`
* `AttachGroupPolicy`, `DetachGroupPolicy`
* `AttachRolePolicy`, `DetachRolePolicy`

These events are high-value signals when they involve privileged policies.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedUserPolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedGroupPolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListAttachedRolePolicies.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.forestall.io/fsprotect/edges/aws/aws_attached_policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.