Check ID: iam_aws_attached_policy_no_administrative_privileges
Provider: AWS
Service: iam
Severity: CRITICAL
Categories: identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM AWS-managed policies attached to identities are inspected for statements that allow Action:'*' on Resource:'*'-i.e., full administrative *:* permissions

​
Risk

Unrestricted *:* access enables any action on any resource, risking:
  • Data exfiltration (confidentiality)
  • Unauthorized changes and policy tampering (integrity)
  • Service deletion or shutdown (availability) Attackers can disable logging, create backdoor principals, and expand lateral movement.

​
Recommendation

Apply least privilege: avoid attaching AWS-managed policies that grant *:*.
  • Use customer-managed, scoped policies per role
  • Enforce separation of duties and permissions boundaries
  • Prefer temporary, time-bound elevation for emergencies with MFA
  • Regularly review access and use conditions to constrain context

​
Remediation

# Replace full admin attachment with a non-admin policy (ensure AdministratorAccess is not attached)
resource "aws_iam_role_policy_attachment" "<example_resource_name>" {
  role       = "<example_resource_name>"
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"  # FIX: avoids '*:*' admin privileges; replace AdministratorAccess
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_aws_attached_policy_no_administrative_privileges. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks