diff --git a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
index d853428ee..cef1f82a7 100644
--- a/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
+++ b/checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
@@ -12,8 +12,9 @@ class IAMPolicyAttachedToGroupOrRoles(BaseResourceCheck):
         super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
 
     def scan_resource_conf(self, conf):
-        if 'user' in conf.keys() or 'users' in conf.keys():
+        if 'user' in conf.keys() or ('users' in conf.keys() and len(conf['users'][0]) > 0):
             return CheckResult.FAILED
         return CheckResult.PASSED
 
+
 check = IAMPolicyAttachedToGroupOrRoles()

Add new check: IAM Policies should not be attached to a user
Attach policies only to groups or roles 

https://www.terraform.io/docs/providers/aws/r/iam_user_policy.html
https://www.terraform.io/docs/providers/aws/r/iam_user_policy_attachment.html
users: https://www.terraform.io/docs/providers/aws/r/iam_policy_attachment.html

Policies / ManagedPolicyArns: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-user.html
Users: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html


diff --git a/tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py b/tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py
index 285dece4f..9f02a4ebe 100644
--- a/tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py
+++ b/tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py
@@ -13,10 +13,23 @@ class TestIAMPolicyAttachedToGroupOrRoles(unittest.TestCase):
 
     def test_failure_2(self):
         resource_conf = {'name': ['test'], 'user': ['${aws_iam_user.lb.name}'], 'policy': [
-            '{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Action": [\n        "ec2:Describe*"\n      ],\n      "Effect": "Allow",\n      "Resource": "*"\n    }\n  ]\n}']}
+            '{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Action": [\n        "ec2:Describe*"\n      ],\n      "Effect": "Allow",'
+            '\n      "Resource": "*"\n    }\n  ]\n}']}
         scan_result = check.scan_resource_conf(conf=resource_conf)
         self.assertEqual(CheckResult.FAILED, scan_result)
 
+    def test_failure_3(self):
+        conf = {'name': ['test-attachment'], 'users': [['${aws_iam_user.user.name}']], 'roles': [['${aws_iam_role.role.name}']],
+                'groups': [['${aws_iam_group.group.name}']], 'policy_arn': ['${aws_iam_policy.policy.arn}']}
+        scan_result = check.scan_resource_conf(conf=conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+    def test_success(self):
+        conf = {'name': ['test-attachment'], 'users': [[]], 'roles': [['${aws_iam_role.role.name}']],
+                'groups': [['${aws_iam_group.group.name}']], 'policy_arn': ['${aws_iam_policy.policy.arn}']}
+        scan_result = check.scan_resource_conf(conf=conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/tests/terraform/test_scanner_registry.py b/tests/terraform/test_scanner_registry.py
index e9052dce7..ef5a0d615 100644
--- a/tests/terraform/test_scanner_registry.py
+++ b/tests/terraform/test_scanner_registry.py
@@ -14,12 +14,13 @@ class TestScannerRegistry(unittest.TestCase):
 
     def test_non_colliding_check_ids(self):
         check_id_check_class_map = {}
-        for (resource_type,checks) in registry.checks.items():
+        for (resource_type, checks) in registry.checks.items():
             for check in checks:
-                check_id_check_class_map.setdefault(check.id,[]).append(check)
+                check_id_check_class_map.setdefault(check.id, []).append(check)
+
+        for check_id, check_classes in check_id_check_class_map.items():
+            self.assertEqual(len(set(check_classes)), 1)
 
-        for check_id,check_classes in check_id_check_class_map.items():
-            self.assertEqual(len(set(check_classes)),1)
 
 if __name__ == '__main__':
     unittest.main()

pip install -e .
parse_log_pytest
pytest
pytest
apt-get update apt-get install -y git
3.7
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs @ file:///croot/attrs_1668696182826/work
certifi @ file:///croot/certifi_1671487769961/work/certifi
chardet==3.0.4
-e git+https://github.com/bridgecrewio/checkov.git@53d4eebf3493703c42035e9efea89fdf8050fb43#egg=checkov
colorama==0.4.3
docopt==0.6.2
dpath==1.5.0
flit_core @ file:///opt/conda/conda-bld/flit-core_1644941570762/work/source/flit_core
idna==2.8
importlib-metadata @ file:///tmp/build/80754af9/importlib-metadata_1648562407465/work
iniconfig @ file:///home/linux1/recipes/ci/iniconfig_1610983019677/work
junit-xml==1.8
lark-parser==0.7.8
packaging @ file:///croot/packaging_1671697413597/work
pluggy @ file:///tmp/build/80754af9/pluggy_1648042572264/work
py @ file:///opt/conda/conda-bld/py_1644396412707/work
pytest==7.1.2
python-hcl2==0.2.0
PyYAML==5.2
requests==2.22.0
six==1.13.0
tabulate==0.8.6
termcolor==1.1.0
tomli @ file:///opt/conda/conda-bld/tomli_1657175507142/work
typing_extensions @ file:///croot/typing_extensions_1669924550328/work
urllib3==1.25.7
zipp @ file:///croot/zipp_1672387121353/work

name: checkov
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - attrs=22.1.0=py37h06a4308_0
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2022.12.7=py37h06a4308_0
  - flit-core=3.6.0=pyhd3eb1b0_0
  - importlib-metadata=4.11.3=py37h06a4308_0
  - importlib_metadata=4.11.3=hd3eb1b0_0
  - iniconfig=1.1.1=pyhd3eb1b0_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - packaging=22.0=py37h06a4308_0
  - pip=22.3.1=py37h06a4308_0
  - pluggy=1.0.0=py37h06a4308_1
  - py=1.11.0=pyhd3eb1b0_0
  - pytest=7.1.2=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tomli=2.0.1=py37h06a4308_0
  - typing_extensions=4.4.0=py37h06a4308_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zipp=3.11.0=py37h06a4308_0
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - chardet==3.0.4
      - colorama==0.4.3
      - docopt==0.6.2
      - dpath==1.5.0
      - idna==2.8
      - junit-xml==1.8
      - lark-parser==0.7.8
      - python-hcl2==0.2.0
      - pyyaml==5.2
      - requests==2.22.0
      - six==1.13.0
      - tabulate==0.8.6
      - termcolor==1.1.0
      - urllib3==1.25.7
prefix: /opt/conda/envs/checkov

tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py::TestIAMPolicyAttachedToGroupOrRoles::test_success
tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py::TestIAMPolicyAttachedToGroupOrRoles::test_failure tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py::TestIAMPolicyAttachedToGroupOrRoles::test_failure_2 tests/terraform/checks/resource/aws/test_IAMPolicyAttachedToGroupOrRoles.py::TestIAMPolicyAttachedToGroupOrRoles::test_failure_3 tests/terraform/test_scanner_registry.py::TestScannerRegistry::test_non_colliding_check_ids tests/terraform/test_scanner_registry.py::TestScannerRegistry::test_num_of_scanners
checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py
checkov/terraform/checks/resource/aws/IAMPolicyAttachedToGroupOrRoles.py