# Ensure report of users with administrative access

- Source: https://support.icompaas.com/support/solutions/articles/62000229704-ensure-report-of-users-with-administrative-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

This policy ensures that a report is generated and shared with the appropriate stakeholders that lists all users who have administrative access to the AWS account. This report can be used to track who has access to sensitive resources and to identify any unauthorized users who may have been granted administrative privileges.

**Rationale:**

The ability to track who has administrative access to an AWS account is essential for maintaining the security of that account. By generating a report of all users with administrative access, organizations can ensure that only authorized users have access to sensitive resources.

**Impact:**

Generating the report of users with administrative access will have no impact on the availability or performance of the AWS account. However, it may increase the amount of data that is stored in AWS.

**Default Value:**

AWS does not generate a report of users with administrative access by default.

**Pre-requisites:**

-   The user must have the appropriate permissions to generate the report of users with administrative access.
-   The user must have access to the AWS Management Console or the AWS CLI.
-   The user must have a shared folder or S3 bucket where the report can be stored.

**Remediation Steps:**

To disable this policy, the user can follow these steps:

1.  In the AWS Management Console, navigate to the **IAM & Admin** page.
2.  Click on the **Policies** tab.
3.  Select the policy that you want to disable.
4.  Click on the **Disable** button.

**Test Plan:**

To test this policy, the user can follow these steps:

1.  Enable the policy.
2.  Generate the report of users with administrative access.
3.  Verify that the report is shared with the appropriate stakeholders.

**Implementation Plan:**

To implement this policy, the user can follow these steps:

1.  Enable the policy.
2.  Generate the report of users with administrative access.
3.  Share the report with the appropriate stakeholders.

**AWS CLI Process:**

To enable this policy using the AWS CLI, the user can run the following command:

```
aws iam update-policy --policy-name <policy-name> --policy-document file://<policy-document-file>
```

The `policy-document-file` file should contain the following JSON:

```
{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iam:GenerateReport",      "Resource": "*"    }  ] }
```

**Using AWS GUI:**

To enable this policy using the AWS GUI, the user can follow these steps:

1.  In the AWS Management Console, navigate to the **IAM & Admin** page.
2.  Click on the **Policies** tab.
3.  Select the policy that you want to enable.
4.  Click on the **Edit** button.
5.  In the **Policy Document** section, paste the following JSON:

```
{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "iam:GenerateReport",      "Resource": "*"    }  ] }
```

6.  Click on the **Save** button.

**Backout Plan:**

To revoke this policy, the user can follow these steps:

1.  In the AWS Management Console, navigate to the **IAM & Admin** page.
2.  Click on the **Policies** tab.
3.  Select the policy that you want to revoke.
4.  Click on the **Delete** button.

**Note:**

-   This policy is not required for all AWS environments.
-   The user should test the policy to ensure that it is working as expected.
-   The user should revoke this policy if it is no longer needed.

**Reference:**

-   AWS IAM Policy Reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference\_policies.html
-   AWS CLI Command Reference: https://docs.aws.amazon.com/cli/latest/reference/iam/

**Section 2:**

-   Tags: users, administrative, access, report, share
-   Keywords: IAM, policy, audit, compliance

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.