# Ensure attached AWS managed IAM policies do not allow full *:* administrative privileges - Source: https://support.icompaas.com/support/solutions/articles/a_1793292210909113-ensure-attached-aws-managed-iam-policies-do-not-allow-full-administrative-privileges - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no AWS managed IAM policy that grants full administrative privileges is attached to IAM users, groups or roles. A policy grants full administrative privileges when it has a statement that allows all actions ("Action": "\*") on all resources ("Resource": "\*"), as the AWS managed AdministratorAccess policy does. **Rationale** A policy that allows every action on every resource gives the identity complete control of the account. If such an identity is compromised or misused, an attacker can read and export any data, change policies and create backdoor users, disable logging and delete resources. Following least privilege, identities should receive customer managed policies scoped to the actions and resources they need, with separation of duties, permissions boundaries and temporary, MFA-protected elevation for emergencies. **Impact** - Limits the damage a compromised user, group or role can cause - Enforces least privilege and separation of duties - Identities that rely on full administrator access may lose permissions they need, so suitable scoped policies must be prepared and attached first - Make sure an approved method for emergency administrative access remains available before removing all administrator policies **Default Value** No AWS managed policy is attached to any IAM identity by default. Full administrative access exists only if a policy such as AdministratorAccess was attached. **Pre-Requisites** - IAM permissions: iam:ListPolicies, iam:GetPolicyVersion, iam:ListEntitiesForPolicy, iam:DetachUserPolicy, iam:DetachGroupPolicy and iam:DetachRolePolicy - Customer managed policies with the permissions each affected user, group or role actually needs - Agreement with the owners of the affected identities on the change **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Policies** in the left menu. 3. Search for AdministratorAccess, open the AWS managed policy and select the **Entities attached** tab. 4. Check whether any users, groups or roles are listed. 5. Also review any other AWS managed policy in use whose JSON allows "Action": "\*" on "Resource": "\*". 6. If such a policy is attached to any identity, follow the implementation steps. **CLI:** List the AWS managed policies that are attached to at least one identity: aws iam list-policies --scope AWS --only-attached --query "Policies\[\].\[PolicyName,Arn,DefaultVersionId\]" --output table Show the document of a policy: aws iam get-policy-version --policy-arn --version-id --query "PolicyVersion.Document" List the users, groups and roles a policy is attached to: aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess The account fails for each attached AWS managed policy that contains an Allow statement for all actions (\*) on all resources (\*). Customer managed and inline policies are not evaluated here. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Attach customer managed policies with only the required permissions to each user, group or role found in the Test Plan. 3. Open the IAM console and select **Policies** in the left menu. 4. Search for the AWS managed policy found in the Test Plan (for example AdministratorAccess) and open it. 5. Select the **Entities attached** tab. 6. Select the users, groups and roles that should no longer have full administrative access and choose **Detach**. 7. Confirm the detachment. **Backout Plan** Before making changes, save the list of identities the policy is attached to: aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess > administratoraccess-entities-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console, select **Policies** and open the AWS managed policy. 3. Select the **Entities attached** tab and choose **Attach**. 4. Select the users, groups and roles listed in the saved backup and choose **Attach policy**. Note: rolling back gives these identities full administrative access again. **Reference** - [https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/access\_policies\_manage-attach-detach.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) - [https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/list-entities-for-policy.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.