IAM group does not have AdministratorAccess policy attached

Check ID: iam_group_administrator_access_policy
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: AwsIamGroup

What this check verifies

IAM groups are assessed for the AWS-managed AdministratorAccess policy attachment. The finding reports any group that has this policy among its attached permissions.

Risk

Group-wide AdministratorAccess gives all members unrestricted control. A stolen or misused account can:

Read/exfiltrate sensitive data (C)
Modify or delete resources and configs (I/A)
Disable logging and weaken defenses, enabling persistence and lateral movement

Recommendation

Remove AdministratorAccess from groups. Apply least privilege with task-scoped, customer-managed policies and separation of duties. Use roles for admin tasks with MFA, time-bound elevation, and auditing. Regularly review group membership and permissions; prefer defense-in-depth guardrails.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam detach-group-policy --group-name <groupname> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# IAM group with no AdministratorAccess attachment
resource "aws_iam_group" "<example_resource_name>" {
  name = "<example_resource_name>"
  # Critical: do NOT create any aws_iam_group_policy_attachment with
  # policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess" for this group
}

# CloudFormation: IAM group without AdministratorAccess attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Group
    Properties:
      GroupName: <example_resource_name>
      ManagedPolicyArns: []  # Critical: empty list ensures AdministratorAccess is NOT attached to the group

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_group_administrator_access_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires