> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/aws/aws_in_group.md).

# AWS\_IN\_GROUP

## Summary

|                                |                                                                                                                                |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| **Forestall ACL Alias**        | AWS\_IN\_GROUP                                                                                                                 |
| **Edge Type**                  | Relationship                                                                                                                   |
| **Affected Object Types**      | IAM Users, IAM Groups                                                                                                          |
| **Exploitation Certainty**     | Certain                                                                                                                        |
| **AWS IAM Action / Condition** | Relationship visibility via `iam:ListGroupsForUser`; membership changes via `iam:AddUserToGroup` and `iam:RemoveUserFromGroup` |

## Description

`AWS_IN_GROUP` means an IAM user belongs to one or more IAM groups.

Group membership is how a user inherits permissions in IAM. A user picks up everything its groups grant:

* Managed policies attached to the group.
* Inline policies defined on the group.

On its own this edge grants nothing to exploit. It matters because it shows where a user's permissions actually come from. That is what you need to trace an escalation chain, especially alongside [`AWS_ATTACHED_POLICY`](https://docs.forestall.io/fsprotect/edges/aws/aws_attached_policy).

## Identification

### AWS CLI

List groups for a user:

```bash
aws iam list-groups-for-user --user-name TargetUser
```

Inspect policy context of a group:

```bash
aws iam list-attached-group-policies --group-name TargetGroup
aws iam list-group-policies --group-name TargetGroup
```

Enumerate all user-group relationships:

```bash
for u in $(aws iam list-users --query 'Users[].UserName' --output text); do
  aws iam list-groups-for-user --user-name "$u" \
    --query "Groups[].{User:'$u',Group:GroupName}" --output table
done
```

### AWS Console

* Open **IAM** -> **Users** -> select a user.
* Open **Groups** tab to review membership.
* Open each group to inspect managed and inline policies.

## Exploitation

This edge has no exploit of its own. It is just membership. The privilege impact comes entirely from what the group's policies grant.

## Mitigation

* Keep IAM groups purpose-specific and least-privilege.
* Regularly review group memberships for privileged groups.
* Remove unnecessary user memberships quickly.
* Use temporary role assumption for elevated tasks when possible.

## Detection

Monitor CloudTrail for membership changes:

* `AddUserToGroup`
* `RemoveUserFromGroup`

Investigate events affecting privileged groups first.

## References

* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_ListGroupsForUser.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_AddUserToGroup.html>
* <https://docs.aws.amazon.com/IAM/latest/APIReference/API_RemoveUserFromGroup.html>
* <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html>