| 💼 [IAM.1] IAM policies should not allow full "*" administrative privileges | | 1 | 1 | |
| 💼 [IAM.2] IAM users should not have IAM policies attached | | 1 | 1 | |
| 💼 [IAM.3] IAM users' access keys should be rotated every 90 days or less | | 1 | 1 | |
| 💼 [IAM.4] IAM root user access key should not exist | | 1 | 1 | |
| 💼 [IAM.5] MFA should be enabled for all IAM users that have a console password | | | 1 | |
| 💼 [IAM.6] Hardware MFA should be enabled for the root user | | | 1 | |
| 💼 [IAM.7] Password policies for IAM users should have strong configurations | | 1 | 2 | |
| 💼 [IAM.8] Unused IAM user credentials should be removed | | | 1 | |
| 💼 [IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services | | | | |