Check ID: iam_inline_policy_no_administrative_privileges
Provider: AWS
Service: iam
Severity: CRITICAL
Categories: identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM inline policies on identities are evaluated for statements allowing Action:"*" on Resource:"*", which indicates unrestricted administrative access.

​
Risk

Granting *:* to an identity collapses least privilege, enabling total control over AWS. A compromised principal can exfiltrate data (confidentiality), alter configs or disable logging (integrity), and delete resources or keys (availability), enabling rapid lateral movement and persistent takeover.

​
Recommendation

Remove Action:"*" with Resource:"*" from inline policies. Apply least privilege with granular actions scoped to specific resources and conditions. Prefer versioned customer-managed policies over broad inline ones, enforce separation of duties, and use permissions boundaries or guardrails to prevent accidental admin grants.

​
Remediation

# Terraform: Inline role policy without '*:*' privileges
resource "aws_iam_role_policy" "<example_resource_name>" {
  name = "leastpriv"
  role = "<example_resource_name>"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:ListBucket"                   # Critical: specific action, not "*"
      Resource = "arn:aws:s3:::<example_resource_name>"  # Critical: specific resource, not "*"
    }]
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_inline_policy_no_administrative_privileges. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks