Description

Ensure that IAM groups do not have the AWS-managed AdministratorAccess policy (or an equivalently broad custom policy) attached directly, and instead rely on more narrowly scoped, role-based permissions appropriate to each group's function.

Rationale

Attaching AdministratorAccess to a group grants every current and future member of that group full administrative privileges over the AWS account, which is rarely appropriate for a group-based access model and significantly increases the blast radius if any single member's credentials are compromised or if a user is mistakenly added to the group. Scoping permissions to what each group's members actually need, following the principle of least privilege, and reserving full administrative access for a small, tightly controlled set of individuals (ideally via just-in-time elevation rather than a standing group policy) reduces this risk.

Impact

  • Reduces the number of principals with standing full administrative access to the account

  • Limits the blast radius of a compromised credential belonging to a member of the group

  • Requires identifying and granting the specific, narrower permissions that group members actually need

Default Value

IAM does not restrict which managed policies can be attached to a group by default; AdministratorAccess can be attached to any group unless prevented by a separate control such as a Service Control Policy.

Pre-Requisites

  • IAM permissions to view and detach group policies (iam:ListAttachedGroupPolicies, iam:DetachGroupPolicy) and to create/attach narrower policies (iam:CreatePolicy, iam:AttachGroupPolicy)

  • A documented understanding of the specific permissions members of the group actually require

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > User groups.

  3. Select each group and open the Permissions tab.

  4. Verify that AdministratorAccess (or an equivalently broad custom policy) is not attached directly to the group.

  5. If AdministratorAccess is attached to a group, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > User groups and select the group with AdministratorAccess attached.

  3. Use IAM Access Analyzer's policy generation feature, or a manual review of the group's actual usage (via CloudTrail), to determine the specific permissions members require.

  4. Create a new, narrowly scoped customer-managed policy reflecting only those required permissions.

  5. Attach the new, narrower policy to the group.

  6. Detach the AdministratorAccess policy from the group, and verify members can still perform their required tasks under the new, least-privilege policy.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to IAM > User groups and select the affected group.

  3. Select Attach policies and re-attach AdministratorAccess, if reverting is required.

Reference