IAM identities should not have the AWSCloudShellFullAccess policy attached

How to fix it

Detach the AWS managed policy AWSCloudShellFullAccess from the identity named. The command matches the identity type: detach-user-policy, detach-role-policy or detach-group-policy. Only direct attachments are read, so a finding on a group clears every member at once. If CloudShell access is still wanted, replace it with a policy that permits starting a session but denies the file transfer actions, which are what make this policy an exfiltration path.

In the console

IAM → Users, Roles or Groups → the identity → Permissions policies

With the AWS CLI

aws iam detach-user-policy --user-name <user-name> --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccess