# 1.16 Ensure IAM Policies with Full ":" Administrative Privileges Are Not Attached (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000233113-1-16-ensure-iam-policies-with-full-administrative-privileges-are-not-attached-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 1](https://support.icompaas.com/support/solutions/folders/62000169194)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

**Level 1**

## **Description:**

AWS IAM policies define permissions for users, groups, and roles. The principle of least privilege states that entities should only have the permissions required to perform their job.

## Rationale:

-   Unrestricted IAM policies allow any action on all AWS resources, increasing the risk of misconfigurations or breaches.
    
-   Attackers can exploit over-permissive roles to escalate privileges and compromise AWS environments.
    
-   Security and compliance frameworks (CIS, SOC 2, ISO 27001, PCI-DSS, HIPAA) require role-based access control (RBAC), not global administrator access.
    

## Impact:

-   Excessive permissions increase the attack surface and expose critical AWS resources.
    
-   Misconfigurations in IAM roles may lead to data leaks, accidental deletions, or unauthorized API calls.
    
-   Organizations with over-permissive IAM policies fail compliance audits.
    

## Default Value:

By default, AWS allows the use of wildcard (\*:\*) permissions, meaning:

-   IAM users, groups, and roles can have full access to AWS resources if administrators do not restrict permissions.
    
-   AWS does not enforce least privilege unless explicitly configured.
    

## Pre-Requisites:

1.  IAM Administrator Access:
    
    -   Requiredpermissions: iam:ListPolicies, iam:GetPolicyVersion, iam:ListEntitiesForPolicy, iam:DetachUserPolicy, iam:DetachGroupPolicy, iam:DetachRolePolicy.
        
2.  AWS CloudTrail (optional):
    
    -   To monitor changes to IAM policies and detect over-permissive policies.
        
3.  AWS Organizations & SCPs (optional):
    
    -   To prevent full ":" policies from being created.
        

## Remediation:

### Test Plan:

## Using Console Steps:

1.  Login to AWS Console as an IAM Administrator.
    
2.  Open IAM Console → Click Policies.
    

                           ![](https://support.icompaas.com/assets/kb/aebdda75006d2ae1.png)

3.  In the search bar, enter "\*:\*" to filter policies.
    
4.  Review each policy:
    
    -   If the Statement contains "Effect": "Allow", "Action": "\*", "Resource": "\*" → The policy is non-compliant.
        
5.  Check which users, groups, or roles have the policy attached.
    

## Using Command Line  Steps:

List all attached IAM policies:

 aws iam list-policies --only-attached --query 'Policies\[\*\].Arn' --output text

For each policy, check if it grants full permissions (":"):

 aws iam get-policy-version --policy-arn <policy\_arn> --version-id <version>

Review the output for any policy with this structure:

 {
    "Effect": "Allow",
    "Action": "\*",
    "Resource": "\*"
}

List all users, groups, or roles attached to the policy:

aws iam list-entities-for-policy --policy-arn <policy\_arn>

Implementation Steps:

Step 1: Detach and Delete Over-Permissive IAM Policies

## Using Console Steps

1.  Login to AWS Console as an IAM Administrator.
    
2.  Open IAM Console → Click Policies.
    

                     ![](https://support.icompaas.com/assets/kb/2acc2b621c78d8ea.png)

3.  Identify policies with "\*:\*" permissions.
    
4.  Click on the policy → Click Detach.                     ![](https://support.icompaas.com/assets/kb/6d4ecbe732e37c16.png)                     
    
5.  Select all users, groups, and roles using the policy → Click Detach Policy.
    
6.  Once detached, select the policy again → Click Delete.           ![](https://support.icompaas.com/assets/kb/90db20896bb6ca2e.png)           
    

## Using Command Line Steps

-   List IAM users, groups, and roles using the policy:

aws iam list-entities-for-policy --policy-arn <policy\_arn>

-   Detach the policy from users:

 aws iam detach-user-policy --user-name <iam\_user> --policy-arn <policy\_arn>

-   Detach the policy from groups:

 aws iam detach-group-policy --group-name <iam\_group> --policy-arn <policy\_arn>

-   Detach the policy from roles:

 aws iam detach-role-policy --role-name <iam\_role> --policy-arn <policy\_arn>

Delete the policy once detached:

 aws iam delete-policy --policy-arn <policy\_arn>

Step 2: Replace with Least Privilege IAM Policies

Instead of full "\*:\*" permissions, create role-specific IAM policies.

Example: Read-Only Policy

{
    "Effect": "Allow",
    "Action": \[
        "s3:ListBucket",
        "ec2:DescribeInstances"
    \],
    "Resource": "\*"
}

Command to Create a New Policy with Least Privilege

aws iam create-policy --policy-name ReadOnlyPolicy --policy-document file://readonly-policy.json

Backout Plan:

If a policy was mistakenly deleted or detached: Recreate the IAM policy using AWS CLI:

aws iam create-policy --policy-name RestoredPolicy --policy-document file://policy.json

Reattach the policy to the required users, groups, or roles:

 aws iam attach-user-policy --user-name <iam\_user> --policy-arn <policy\_arn>

Ensure the policy follows the least privilege model before reattaching.

##   

## References:

-   [AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
    
-   [AWS CLI IAM Policy Management](https://docs.aws.amazon.com/cli/latest/reference/iam/index.html)
    
-   [](https://www.cisecurity.org/benchmark/amazon_web_services)[CIS AWS Benchmark IAM Policy Controls](https://www.cisecurity.org/benchmark/amazon_web_services)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.