A config rule that checks whether the IAM policy ARN is attached to an IAM user, or an IAM group with one or more IAM users, or an IAM role with one or more trusted entity.

This config rule supports the following parameters:

  • policyARN
    • Required: Yes
    • Type: String
    • Description:An IAM policy ARN to be checked.
  • policyUsageType
    • Required: No
    • Type: String
    • Description:Specify whether you expect the policy to be attached to an IAM user, group or role. Valid values are IAM_USER, IAM_GROUP, IAM_ROLE, or ANY.
    • Default Value: ANY

CloudFormation Template