# 1.15 Ensure IAM policies that allow full ":" administrative privileges are not attached (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000234210-1-15-ensure-iam-policies-that-allow-full-administrative-privileges-are-not-attached-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: IAM policies that allow the \*:\* wildcard (e.g., "Action": "\*", "Resource": "\*") grant full administrative access to all AWS services and resources. While such policies may be convenient for managing permissions in a broad manner, they violate the principle of least privilege, which suggests granting users the minimum permissions necessary to perform their job. Allowing full administrative privileges without restrictions increases the risk of unauthorized access, malicious activity, or accidental resource mismanagement. By ensuring that IAM policies do not contain \*:\* wildcards, organizations can enforce stricter access controls, ensuring that only authorized users have access to specific resources with the necessary permissions. #### Rationale: Ensuring that IAM policies do not allow full administrative privileges provides the following benefits: - Security: Restricts unnecessary access, reducing the risk of unauthorized access or malicious actions. - Compliance: Helps meet compliance standards (e.g., HIPAA, PCI-DSS) that require the principle of least privilege and controlled access to resources. - Reduced risk of misconfiguration: Limits the ability to make broad and potentially damaging changes to AWS resources. - Auditability: Makes it easier to track and monitor permissions, ensuring that users have access only to the resources they need. Without restricting \*:\* wildcard policies, users may inadvertently or intentionally gain full access to sensitive resources, leading to potential data breaches or disruptions. #### Impact: Failure to remove policies with full administrative privileges (\*:\*) can result in: - Unrestricted access to sensitive data and AWS resources. - Security vulnerabilities due to over-permissioned accounts. - Non-compliance with regulatory and security standards requiring the application of least-privilege principles. By removing \*:\* policies, organizations can ensure that access to AWS services and resources is tightly controlled and limited to necessary actions only. #### Default Value: By default, AWS does not attach \*:\* policies to IAM users, groups, or roles unless explicitly configured. However, if such a policy is attached, it allows full access to all AWS services and resources. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - iam:ListPolicies - iam:DetachUserPolicy - iam:ListAttachedUserPolicies - iam:ListAttachedRolePolicies - iam:ListAttachedGroupPolicies - IAM roles, users, and policies must be accessible for review and modification #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [IAM Console](https://console.aws.amazon.com/iam/). 2. Navigate to Policies and search for any policies that contain \*:\* in the Action or Resource fields. 3. Review any policies that allow full administrative access, such as AdministratorAccess, and assess whether these should be restricted or removed for specific users, groups, or roles. 4. Review attached policies for users, groups, or roles to ensure no policies with broad \*:\* permissions are being used. Using AWS CLI: aws iam list-attached-user-policies --user-name --query "AttachedPolicies\[?PolicyName=='AdministratorAccess'\]" --output table To check the policy document for the \*:\* permissions: aws iam get-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --version-id ##### Implementation Plan: Using AWS Console: 1. Remove or modify policies that allow \*:\* access: - Go to the [IAM Console](https://console.aws.amazon.com/iam/). - Under Policies, identify policies with "Action": "\*" and "Resource": "\*". - Either remove these policies from users, groups, or roles or modify the policies to restrict access to specific resources. 2. Create more restrictive policies: - Create custom policies that limit access to only the required services and actions, following the principle of least privilege. - Attach these new policies to users, groups, or roles as necessary. Using AWS CLI: 1. Detach policies with \*:\* permissions from users, groups, or roles: aws iam detach-user-poliy --user-name --policy-arn arn:aws:iam::aws:policy/AdministratorAccess 2. Remove or replace \*:\* policies with more restrictive custom policies: - Use the aws iam create-policy command to create new, restricted policies. - Attach these new policies using aws iam attach-user-policy, aws iam attach-role-policy, or aws iam attach-group-policy. 3. Check all policies for \*:\* permissions: aws iam list-policies --query "Policies\[?PolicyName=='AdministratorAccess'\]" --output table #### Backout Plan: Using AWS Console: 1. If removing the \*:\* policy causes issues with legitimate access: - Go to the [IAM Console](https://console.aws.amazon.com/iam/). - Reattach the removed \*:\* policy (e.g., AdministratorAccess) to the affected IAM user, group, or role. 2. Modify IAM permissions to balance security with functionality as necessary, ensuring the least privilege is maintained. Using AWS CLI: 1. Reattach the \*:\* policy if required: aws iam attach-user-policy --user-name --policy-arn arn:aws:iam::aws:policy/AdministratorAccess 2. Revert any restrictive policy changes that caused access issues and review IAM permissions for fine-tuning. #### References: - [AWS IAM Documentation ](https://docs.aws.amazon.com/IAM/latest/UserGuide/) - [AWS CLI Command Reference for IAM ](https://docs.aws.amazon.com/cli/latest/reference/iam/) - [AWS Security Best Practices ](https://aws.amazon.com/security/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.