# Ensure IAM Group Does Not Have AdministratorAccess Policy Attached

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890040833893-ensure-iam-group-does-not-have-administratoraccess-policy-attached
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that IAM groups do not have the AWS-managed AdministratorAccess policy (or an equivalently broad custom policy) attached directly, and instead rely on more narrowly scoped, role-based permissions appropriate to each group's function.

**Rationale**

Attaching AdministratorAccess to a group grants every current and future member of that group full administrative privileges over the AWS account, which is rarely appropriate for a group-based access model and significantly increases the blast radius if any single member's credentials are compromised or if a user is mistakenly added to the group. Scoping permissions to what each group's members actually need, following the principle of least privilege, and reserving full administrative access for a small, tightly controlled set of individuals (ideally via just-in-time elevation rather than a standing group policy) reduces this risk.

**Impact**

-   Reduces the number of principals with standing full administrative access to the account
    
-   Limits the blast radius of a compromised credential belonging to a member of the group
    
-   Requires identifying and granting the specific, narrower permissions that group members actually need
    

**Default Value**

IAM does not restrict which managed policies can be attached to a group by default; AdministratorAccess can be attached to any group unless prevented by a separate control such as a Service Control Policy.

**Pre-Requisites**

-   IAM permissions to view and detach group policies (iam:ListAttachedGroupPolicies, iam:DetachGroupPolicy) and to create/attach narrower policies (iam:CreatePolicy, iam:AttachGroupPolicy)
    
-   A documented understanding of the specific permissions members of the group actually require
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to IAM > User groups.
    
3.  Select each group and open the Permissions tab.
    
4.  Verify that AdministratorAccess (or an equivalently broad custom policy) is not attached directly to the group.
    
5.  If AdministratorAccess is attached to a group, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to IAM > User groups and select the group with AdministratorAccess attached.
    
3.  Use IAM Access Analyzer's policy generation feature, or a manual review of the group's actual usage (via CloudTrail), to determine the specific permissions members require.
    
4.  Create a new, narrowly scoped customer-managed policy reflecting only those required permissions.
    
5.  Attach the new, narrower policy to the group.
    
6.  Detach the AdministratorAccess policy from the group, and verify members can still perform their required tasks under the new, least-privilege policy.
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to IAM > User groups and select the affected group.
    
3.  Select Attach policies and re-attach AdministratorAccess, if reverting is required.
    

**Reference**

-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
    
-   [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_groups.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.