Description

Ensure that no IAM group has a policy named AdministratorAccess attached. The match is by policy name only, which normally identifies the AWS managed policy, but a customer managed policy with the same name is also counted; the policy ARN is not verified. The AWS managed policy grants full access to all AWS services and resources, and when it is attached to a group, every member of the group receives those permissions.

Rationale

Attaching AdministratorAccess to a group gives unrestricted control of the account to every current and future member. If any member's credentials are stolen or misused, an attacker can read and exfiltrate data, change or delete resources, and disable logging to hide their activity. Groups should be granted only the permissions their members need, and administrative tasks should be performed through roles with MFA, time-limited elevation and auditing.

Impact

  • Removes full administrative access from all members of the group

  • Members who need specific permissions lose them unless a least-privilege policy is attached first

  • Administrators who rely on the group must use another approved method, such as an administrative role, to perform administrative tasks

Default Value

AWS does not attach AdministratorAccess to any IAM group by default. It is present only if it was attached.

Pre-Requisites

  • IAM permissions: iam:ListGroups, iam:ListAttachedGroupPolicies, iam:ListEntitiesForPolicy, iam:DetachGroupPolicy and iam:AttachGroupPolicy

  • A list of the permissions each group's members actually need, and a least-privilege policy to replace AdministratorAccess

  • An alternative administrative access path (for example, an administrative role with MFA) so that administrators are not locked out

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select Policies.

  3. Search for and open the AdministratorAccess policy.

  4. Open the Entities attached tab and check for entities of type Group.

  5. If any group is listed, follow the implementation steps.

CLI:

List the groups that have the AdministratorAccess policy attached:

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --entity-filter Group --query "PolicyGroups[].GroupName"

Show the managed policies attached to a group:

aws iam list-attached-group-policies --group-name <GROUP_NAME> --query "AttachedPolicies[].[PolicyName,PolicyArn]" --output table

A group fails if any of its attached managed policies is named AdministratorAccess, whether it is the AWS managed policy or a customer managed policy with the same name.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select User groups, then the group.

  3. On the Permissions tab, attach a least-privilege policy if the members still need some permissions.

  4. Select AdministratorAccess and choose Remove.

  5. Confirm the removal.

CLI:

Detach the AdministratorAccess policy from the group:

aws iam detach-group-policy --group-name <GROUP_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Attach a least-privilege policy if the members still need some permissions:

aws iam attach-group-policy --group-name <GROUP_NAME> --policy-arn <POLICY_ARN>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the IAM console and select User groups, then the group.

  3. On the Permissions tab, choose Add permissions, then Attach policies.

  4. Select AdministratorAccess and choose Attach policies.

CLI:

aws iam attach-group-policy --group-name <GROUP_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Note: rolling back gives every member of the group full administrative access again. Use it only as a temporary measure.

Reference