Customer-managed IAM policy allows no privilege escalation

Check ID: iam_policy_allows_privilege_escalation
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: AwsIamPolicy

What this check verifies

Customer-managed IAM policies are evaluated for permissions that enable privilege escalation, including creating or updating policies, altering role trust, attaching higher-privilege policies, or using iam:PassRole to obtain broader access.

Risk

Privilege-escalation permissions let principals assume higher-privilege roles or attach admin policies, impacting:

Confidentiality via unauthorized data access/exfiltration
Integrity by modifying policies, configs, or logs
Availability through resource deletion or disabling controls

Recommendation

Apply least privilege to customer policies:

Avoid wildcards in Action and Resource
Remove or tightly scope iam:PassRole, policy attach/update, and trust-policy changes
Use conditions like iam:PassedToService and tags to constrain use
Enforce permissions boundaries and SCPs
Separate duties with change review

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam create-policy-version --policy-arn <example_resource_id> --set-as-default --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}'

resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  # Critical: Deny all actions so the policy cannot allow privilege escalation
  policy = jsonencode({
    Version   = "2012-10-17",
    Statement = [{
      Effect   = "Deny",
      Action   = "*",
      Resource = "*"
    }]
  })
}

Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny  # Critical: Denies all actions so the policy cannot allow privilege escalation
            Action: "*"
            Resource: "*"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_policy_allows_privilege_escalation. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires