IAM users should not have IAM policies attached

How to fix it

Detach every policy attached directly to the user and grant the same permission through a group instead. Both kinds count, a managed policy attached to the user and an inline policy embedded in it, and the evidence names which were found. Add the user to the group before detaching, or you cut their access in the gap. An inline policy cannot be moved: its content has to be recreated on the group. If the policy is AWSCloudShellFullAccess, that control wants it removed outright rather than moved.

In the console

IAM → Users → the user → Permissions policies

With the AWS CLI

aws iam detach-user-policy --user-name <user-name> --policy-arn <policy-arn>

With Terraform

resource "aws_iam_group_policy_attachment" "this" {
  group      = var.group_name
  policy_arn = var.policy_arn
}