> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/search-and-reports/aws-entities/aws-iam-group.md).

# IAM Group

### AWS IAM Group Fields

| Field          | Type    | Possible Operators                                             | Description                                                                                                                    |
| -------------- | ------- | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Guid           | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of the GUID of the selected Scan and the AWS IAM Group's unique ID.                  |
| FSName         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the GroupName and the AWS Account ID.                                     |
| Arn            | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Amazon Resource Name that uniquely identifies this IAM group across all of AWS.                                                |
| AccountId      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The AWS account ID that this IAM group belongs to.                                                                             |
| Region         | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The AWS region associated with this IAM group.                                                                                 |
| OrganizationId | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The AWS Organizations ID that this group's account belongs to.                                                                 |
| GroupName      | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The friendly name that identifies the IAM group.                                                                               |
| Path           | TEXT    | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The path to the group in the IAM hierarchy. Used to organize groups.                                                           |
| MemberCount    | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The number of IAM users that are direct members of this group.                                                                 |
| IsStealth      | BOOLEAN | N/A                                                            | Indicates that the group can compromise admin objects with at least one attack path without being an explicit admin group.     |
| AWSTier        | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Privilege tier of the group based on the effective permissions granted by its attached policies.                               |
| CreateDate     | DATE    | SMALLER, LARGER, BETWEEN, EQUAL                                | The date and time when the IAM group was created.                                                                              |
| ExposurePoint  | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | A numerical value indicating the level of exposure based on how many other entities can reach this group through attack paths. |
| risk           | NUMBER  | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the group calculated based on vulnerability counts and severities.                                           |