Description

Ensure that no AWS managed IAM policy that grants full administrative privileges is attached to IAM users, groups or roles. A policy grants full administrative privileges when it has a statement that allows all actions ("Action": "*") on all resources ("Resource": "*"), as the AWS managed AdministratorAccess policy does.

Rationale

A policy that allows every action on every resource gives the identity complete control of the account. If such an identity is compromised or misused, an attacker can read and export any data, change policies and create backdoor users, disable logging and delete resources. Following least privilege, identities should receive customer managed policies scoped to the actions and resources they need, with separation of duties, permissions boundaries and temporary, MFA-protected elevation for emergencies.

Impact

  • Limits the damage a compromised user, group or role can cause

  • Enforces least privilege and separation of duties

  • Identities that rely on full administrator access may lose permissions they need, so suitable scoped policies must be prepared and attached first

  • Make sure an approved method for emergency administrative access remains available before removing all administrator policies

Default Value

No AWS managed policy is attached to any IAM identity by default. Full administrative access exists only if a policy such as AdministratorAccess was attached.

Pre-Requisites

  • IAM permissions: iam:ListPolicies, iam:GetPolicyVersion, iam:ListEntitiesForPolicy, iam:DetachUserPolicy, iam:DetachGroupPolicy and iam:DetachRolePolicy

  • Customer managed policies with the permissions each affected user, group or role actually needs

  • Agreement with the owners of the affected identities on the change

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies in the left menu.

  3. Search for AdministratorAccess, open the AWS managed policy and select the Entities attached tab.

  4. Check whether any users, groups or roles are listed.

  5. Also review any other AWS managed policy in use whose JSON allows "Action": "*" on "Resource": "*".

  6. If such a policy is attached to any identity, follow the implementation steps.

CLI:

List the AWS managed policies that are attached to at least one identity:

aws iam list-policies --scope AWS --only-attached --query "Policies[].[PolicyName,Arn,DefaultVersionId]" --output table

Show the document of a policy:

aws iam get-policy-version --policy-arn <POLICY_ARN> --version-id <VERSION_ID> --query "PolicyVersion.Document"

List the users, groups and roles a policy is attached to:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

The account fails for each attached AWS managed policy that contains an Allow statement for all actions (*) on all resources (*). Customer managed and inline policies are not evaluated here.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Attach customer managed policies with only the required permissions to each user, group or role found in the Test Plan.

  3. Open the IAM console and select Policies in the left menu.

  4. Search for the AWS managed policy found in the Test Plan (for example AdministratorAccess) and open it.

  5. Select the Entities attached tab.

  6. Select the users, groups and roles that should no longer have full administrative access and choose Detach.

  7. Confirm the detachment.

Backout Plan

Before making changes, save the list of identities the policy is attached to:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess > administratoraccess-entities-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Policies and open the AWS managed policy.

  3. Select the Entities attached tab and choose Attach.

  4. Select the users, groups and roles listed in the saved backup and choose Attach policy.

Note: rolling back gives these identities full administrative access again.

Reference