Control: AWS > Turbot > IAM > User > Managed

The control focuses on the Turbot-managed user accounts, this control updates and deletes user accounts based on their assignment status. It also applies necessary lockdown, boundary, and deny policies to user accounts, further tightening security. Additionally, it controls group memberships by removing users from groups that are associated outside of Turbot, depending on the policy AWS > Turbot > Permissions > User > Group Membership Mode. This ensures that user access levels are consistently managed and aligned with the organization's access control policies.

Resource Types

This control targets the following resource types:

AWS > IAM > User

Policies

This control type relies on these other policies when running actions:

Permissions

Cloud permissions used by this control and its actions:

iam:DeactivateMFADevice
iam:DeleteAccessKey
iam:DeleteLoginProfile
iam:DeleteUser
iam:DeleteUserPolicy
iam:DeleteVirtualMFADevice
iam:DetachUserPolicy
iam:ListAccessKeys
iam:ListMFADevices
iam:RemoveUserFromGroup
iam:PutUserPermissionsBoundary
iam:DeleteUserPermissionsBoundary
iam:UntagUser
iam:TagUser
iam:AttachUserPolicy
iam:DetachUserPolicy
iam:RemoveUserFromGroup

In Your Workspace

Developers

Control Type URI

tmod:@turbot/aws-iam#/control/types/iamTurbotUserManaged

Category URI

tmod:@turbot/turbot#/control/categories/iam

GraphQL

query controlType(id: "tmod:@turbot/aws-iam#/control/types/iamTurbotUserManaged") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/aws-iam#/control/types/iamTurbotUserManaged'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/aws-iam#/control/types/iamTurbotUserManaged"