IAM role does not have AdministratorAccess policy attached

Check ID: iam_role_administratoraccess_policy
Provider: AWS
Service: iam
Severity: HIGH
Categories: identity-access
Resource type: AwsIamRole

What this check verifies

IAM roles (excluding service roles) are evaluated for attachment of the AWS-managed AdministratorAccess policy. Attachment indicates the role holds unrestricted permissions across services and resources.

Risk

Granting full administrative permissions on a role undermines confidentiality, integrity, and availability. If the role is assumed or its credentials are stolen, an attacker can read sensitive data, change policies, disable auditing, delete resources and backups, and create new privileged identities, enabling swift account takeover.

Recommendation

Apply least privilege: avoid attaching AdministratorAccess to roles. Grant only task-scoped permissions with custom policies and enforce separation of duties. Use permissions boundaries, SCPs, and policy conditions to constrain power. Require MFA for break-glass admins, time-bound elevation with approval, and refine access using Access Analyzer.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam detach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

# IAM Role without AdministratorAccess
resource "aws_iam_role" "<example_resource_name>" {
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "ec2.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
POLICY

  managed_policy_arns = [] # Critical: ensures "AdministratorAccess" is NOT attached
}

# CloudFormation: IAM Role without AdministratorAccess
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns: []  # Critical: ensure AdministratorAccess is NOT attached to this role

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_role_administratoraccess_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires