Query: iam_roles_without_direct_attached_policy_count

select
  count(*) as value,
  'Without Attached Policies' as label,
  case
    when count(*) > 0 then 'alert'
    else 'ok'
  end as type
from
  aws_iam_role
where
  attached_policy_arns is null;