Check ID: iam_user_administrator_access_policy
Provider: AWS
Service: iam
Severity: CRITICAL
Categories: identity-access
Resource type: AwsIamUser

​
What this check verifies

IAM users are evaluated for a direct attachment of the AWS managed policy AdministratorAccess. The finding identifies identities where this policy appears among the user’s attached policies.

​
Risk

Assigning an IAM user full admin rights concentrates power in long-lived credentials. If compromised, attackers gain:
  • Confidentiality: read/export all data
  • Integrity: change configs, policies, code
  • Availability: delete resources, disrupt services Also enables persistence and uncontrolled spend.

​
Recommendation

Remove direct AdministratorAccess from users.
  • Apply least privilege with scoped policies
  • Use federation and roles for temporary admin access
  • Enforce separation of duties and approvals
  • Add guardrails (SCPs, permissions boundaries)
  • Require MFA and rotate any remaining long-lived credentials

​
Remediation

aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_user_administrator_access_policy. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks