# Ensure unattached custom IAM policies do not allow full admin access - Source: https://support.icompaas.com/support/solutions/articles/a_1793292244426675-ensure-unattached-custom-iam-policies-do-not-allow-full-admin-access - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no customer managed IAM policy that is not attached to any user, group or role grants full administrative privileges. A policy grants full administrative privileges when a statement allows all actions ("Action": "\*") on all resources ("Resource": "\*"), or uses NotAction on all resources, which the check treats as full access regardless of what is excluded. **Rationale** An unattached policy with full administrative privileges is not used today, but it can be attached to a user, group or role at any time, by mistake or by an attacker. Once attached, it gives complete control of the account, allowing data theft, resource changes or deletion, service disruption and privilege escalation. Such policies should be deleted or rewritten to grant only the specific actions and resources needed, with permissions boundaries and service control policies as guardrails. **Impact** - Removes a ready-made path to full account access - The policy is not attached to any identity, so no user or workload loses access - Automation or templates that expect to attach this policy later must be updated to use a least-privilege policy **Default Value** AWS does not create customer managed policies. They exist only if they were created in the account. **Pre-Requisites** - IAM permissions: iam:ListPolicies, iam:GetPolicy, iam:GetPolicyVersion, iam:ListPolicyVersions, iam:CreatePolicyVersion, iam:SetDefaultPolicyVersion, iam:DeletePolicyVersion and iam:DeletePolicy - Confirmation from the policy owner whether the policy is still needed and, if so, which actions and resources it should allow **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Policies**. 3. Filter by type **Customer managed** and check the **Used as** column for policies that are not used. 4. Open each unused policy and review its JSON on the **Permissions** tab. 5. If any statement has "Effect": "Allow", "Action": "\*" and "Resource": "\*", follow the implementation steps. **CLI:** List the customer managed policies that are not attached to any identity: aws iam list-policies --scope Local --query "Policies\[?AttachmentCount==\\\`0\\\`\].\[PolicyName,Arn,DefaultVersionId\]" --output table Show the default version of a policy: aws iam get-policy-version --policy-arn --version-id --query "PolicyVersion.Document" A policy fails if an Allow statement grants action \* on resource \*, or if any Allow statement uses NotAction on resource \* (treated as full access regardless of what is excluded). **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Policies**, then the unattached policy. 3. If the policy is not needed, choose **Delete**, confirm by entering the policy name, and choose **Delete**. 4. Otherwise, choose **Edit** and open the **JSON** editor. 5. Replace the statement that allows \* actions on \* resources with statements that allow only the required actions on specific resources. 6. Choose **Next**, then **Save changes**. **CLI:** Save the least-privilege policy as policy.json, replacing the example statement with the permissions that are actually needed: {"Version":"2012-10-17","Statement":\[{"Effect":"Allow","Action":\[":"\],"Resource":""}\]} Create a new default version of the policy from the file (a policy can have at most five versions, so delete an old non-default version first if needed): aws iam create-policy-version --policy-arn --policy-document file://policy.json --set-as-default If the policy is not needed, delete its non-default versions and then the policy: aws iam list-policy-versions --policy-arn --query "Versions\[?IsDefaultVersion==\\\`false\\\`\].VersionId" aws iam delete-policy-version --policy-arn --version-id aws iam delete-policy --policy-arn **Backout Plan** Before making changes, save the current policy document: aws iam get-policy-version --policy-arn --version-id > policy-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console, select **Policies** and open the policy. 3. On the **Policy versions** tab, select the previous version and choose **Set as default**. 4. If the policy was deleted, create it again from the saved backup. **CLI:** aws iam set-default-policy-version --policy-arn --version-id Note: rolling back restores a policy that can grant full administrative access as soon as it is attached. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/access\_policies\_manage-versioning.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-versioning.html) - [https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy-version.html](https://docs.aws.amazon.com/cli/latest/reference/iam/create-policy-version.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.