IAM entity uses an AWS-managed policy

What it means

A role, user or group attaches an AWS-managed policy rather than a customer-managed one.

Why it matters

AWS-managed policies are written to fit every customer, so they grant far more than any single workload needs. They also change: AWS updates them, and your role quietly gains permissions without you deploying anything. This one fires constantly on Lambda, because the default execution role attaches AWSLambdaBasicExecutionRole.

How to fix it

Define a role with an inline policy scoped to what the function needs — usually just logs:CreateLogStream and logs:PutLogEvents on its own log group.

See it fail

This stack trips AwsSolutions-IAM4 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules