Description

Ensure that customer-managed IAM policies that are not currently attached to any user, group, or role, do not grant broad administrative privileges using a statement such as Effect: Allow, Action: '*', Resource: '*', or similarly broad wildcard patterns like 'service:*'.

Rationale

Unattached policies with overly broad administrative permissions represent latent risk: they are not actively enforced today, but if mistakenly attached to a principal in the future, whether by an automation script, a well-intentioned but hasty administrator, or a compromised account making IAM changes, they immediately grant excessive privileges. Identifying and either tightening or removing such policies before they are attached reduces the chance of an accidental privilege escalation.

Impact

  • Reduces the risk of unintentional privilege escalation if a leftover overly broad policy is later attached to a principal

  • Encourages IAM policy hygiene and least-privilege policy design across the account

  • Requires reviewing whether the policy was intentionally created for a specific, tightly controlled use case before deleting or modifying it

Default Value

IAM does not restrict what policy documents can be authored or left unattached; there is no default protection against overly broad, unattached policies existing in the account.

Pre-Requisites

  • IAM permissions to list and review customer-managed policies (iam:ListPolicies, iam:GetPolicyVersion) and to delete or edit them (iam:DeletePolicy, iam:CreatePolicyVersion)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > Policies.

  3. Filter for Customer managed policies and review each policy's Attached entities count.

  4. For each policy with zero attachments, open the policy and review its JSON policy document.

  5. Verify that no statement grants Effect: Allow with Action: '*' and Resource: '*' (or an equally broad wildcard) without a scoping condition.

  6. If an unattached policy grants overly broad administrative privileges, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > Policies and select the unattached policy with overly broad permissions.

  3. Determine whether the policy is still needed; if not, select Delete policy and confirm.

  4. If the policy is still needed for a legitimate, narrower purpose, select Edit policy and revise the statement to scope Action and Resource to only the specific services, actions, and resource ARNs required.

  5. Create a new policy version with the revised, least-privilege statement, and set it as the default version.

  6. Verify the policy document no longer contains an unscoped Action: '*', Resource: '*' statement.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > Policies and select the affected policy.

  3. Select Edit policy and create a new version restoring the broader Action: '*', Resource: '*' statement, if reverting is required.

  4. Set the restored version as the default version.

Reference