Unattached customer policy grants no '*:*' access

Check ID: iam_customer_unattached_policy_no_administrative_privileges
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

Customer-managed IAM policies that are unattached are evaluated for statements granting full administrative access using *:* wildcards. The focus is on policies whose documents include unrestricted actions on all resources.

Risk

An unattached policy with *:* can be attached accidentally or maliciously, granting account-wide control. Attackers could read sensitive data (confidentiality), alter or delete resources (integrity), and disrupt services (availability), enabling rapid privilege escalation and lateral movement.

Recommendation

Remove or redesign these policies to enforce least privilege:

Avoid * in actions/resources; scope precisely and use conditions
Apply permissions boundaries and SCPs as guardrails
Require peer review and policy validation before attachment
Use analysis tools to refine permissions and delete unused policies

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam create-policy-version --policy-arn <example_resource_arn> --set-as-default --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:GetAccountSummary","Resource":"*"}]}'

# IAM policy without '*:*' administrative privileges
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "iam:GetAccountSummary"   # Critical: specific action, not '*'
        Resource = "*"                        # Critical: avoids '*:*' admin privileges
      }
    ]
  })
}

# CloudFormation: managed policy without administrative '*:*' privileges
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: iam:GetAccountSummary  # Critical: use a specific action instead of '*'
            Resource: "*"                 # Critical: combined with specific action, avoids '*:*'

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_customer_unattached_policy_no_administrative_privileges. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Attached customer-managed policy grants no '*:*' access IAM group does not have AdministratorAccess policy attached

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires