Description

Ensure that no customer managed IAM policy that is not attached to any user, group or role grants full administrative privileges. A policy grants full administrative privileges when a statement allows all actions ("Action": "*") on all resources ("Resource": "*"), or uses NotAction on all resources, which the check treats as full access regardless of what is excluded.

Rationale

An unattached policy with full administrative privileges is not used today, but it can be attached to a user, group or role at any time, by mistake or by an attacker. Once attached, it gives complete control of the account, allowing data theft, resource changes or deletion, service disruption and privilege escalation. Such policies should be deleted or rewritten to grant only the specific actions and resources needed, with permissions boundaries and service control policies as guardrails.

Impact

  • Removes a ready-made path to full account access

  • The policy is not attached to any identity, so no user or workload loses access

  • Automation or templates that expect to attach this policy later must be updated to use a least-privilege policy

Default Value

AWS does not create customer managed policies. They exist only if they were created in the account.

Pre-Requisites

  • IAM permissions: iam:ListPolicies, iam:GetPolicy, iam:GetPolicyVersion, iam:ListPolicyVersions, iam:CreatePolicyVersion, iam:SetDefaultPolicyVersion, iam:DeletePolicyVersion and iam:DeletePolicy

  • Confirmation from the policy owner whether the policy is still needed and, if so, which actions and resources it should allow

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies.

  3. Filter by type Customer managed and check the Used as column for policies that are not used.

  4. Open each unused policy and review its JSON on the Permissions tab.

  5. If any statement has "Effect": "Allow", "Action": "*" and "Resource": "*", follow the implementation steps.

CLI:

List the customer managed policies that are not attached to any identity:

aws iam list-policies --scope Local --query "Policies[?AttachmentCount==\`0\`].[PolicyName,Arn,DefaultVersionId]" --output table

Show the default version of a policy:

aws iam get-policy-version --policy-arn <POLICY_ARN> --version-id <VERSION_ID> --query "PolicyVersion.Document"

A policy fails if an Allow statement grants action * on resource *, or if any Allow statement uses NotAction on resource * (treated as full access regardless of what is excluded).

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies, then the unattached policy.

  3. If the policy is not needed, choose Delete, confirm by entering the policy name, and choose Delete.

  4. Otherwise, choose Edit and open the JSON editor.

  5. Replace the statement that allows * actions on * resources with statements that allow only the required actions on specific resources.

  6. Choose Next, then Save changes.

CLI:

Save the least-privilege policy as policy.json, replacing the example statement with the permissions that are actually needed:

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["<SERVICE>:<ACTION>"],"Resource":"<RESOURCE_ARN>"}]}

Create a new default version of the policy from the file (a policy can have at most five versions, so delete an old non-default version first if needed):

aws iam create-policy-version --policy-arn <POLICY_ARN> --policy-document file://policy.json --set-as-default

If the policy is not needed, delete its non-default versions and then the policy:

aws iam list-policy-versions --policy-arn <POLICY_ARN> --query "Versions[?IsDefaultVersion==\`false\`].VersionId"
aws iam delete-policy-version --policy-arn <POLICY_ARN> --version-id <VERSION_ID>
aws iam delete-policy --policy-arn <POLICY_ARN>

Backout Plan

Before making changes, save the current policy document:

aws iam get-policy-version --policy-arn <POLICY_ARN> --version-id <VERSION_ID> > policy-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console, select Policies and open the policy.

  3. On the Policy versions tab, select the previous version and choose Set as default.

  4. If the policy was deleted, create it again from the saved backup.

CLI:

aws iam set-default-policy-version --policy-arn <POLICY_ARN> --version-id <PREVIOUS_VERSION_ID>

Note: rolling back restores a policy that can grant full administrative access as soon as it is attached.

Reference