# Ensure IAM group does not have AdministratorAccess policy attached - Source: https://support.icompaas.com/support/solutions/articles/a_1793292244820728-ensure-iam-group-does-not-have-administratoraccess-policy-attached - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that no IAM group has a policy named AdministratorAccess attached. The match is by policy name only, which normally identifies the AWS managed policy, but a customer managed policy with the same name is also counted; the policy ARN is not verified. The AWS managed policy grants full access to all AWS services and resources, and when it is attached to a group, every member of the group receives those permissions. **Rationale** Attaching AdministratorAccess to a group gives unrestricted control of the account to every current and future member. If any member's credentials are stolen or misused, an attacker can read and exfiltrate data, change or delete resources, and disable logging to hide their activity. Groups should be granted only the permissions their members need, and administrative tasks should be performed through roles with MFA, time-limited elevation and auditing. **Impact** - Removes full administrative access from all members of the group - Members who need specific permissions lose them unless a least-privilege policy is attached first - Administrators who rely on the group must use another approved method, such as an administrative role, to perform administrative tasks **Default Value** AWS does not attach AdministratorAccess to any IAM group by default. It is present only if it was attached. **Pre-Requisites** - IAM permissions: iam:ListGroups, iam:ListAttachedGroupPolicies, iam:ListEntitiesForPolicy, iam:DetachGroupPolicy and iam:AttachGroupPolicy - A list of the permissions each group's members actually need, and a least-privilege policy to replace AdministratorAccess - An alternative administrative access path (for example, an administrative role with MFA) so that administrators are not locked out **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **Policies**. 3. Search for and open the **AdministratorAccess** policy. 4. Open the **Entities attached** tab and check for entities of type **Group**. 5. If any group is listed, follow the implementation steps. **CLI:** List the groups that have the AdministratorAccess policy attached: aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --entity-filter Group --query "PolicyGroups\[\].GroupName" Show the managed policies attached to a group: aws iam list-attached-group-policies --group-name --query "AttachedPolicies\[\].\[PolicyName,PolicyArn\]" --output table A group fails if any of its attached managed policies is named AdministratorAccess, whether it is the AWS managed policy or a customer managed policy with the same name. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **User groups**, then the group. 3. On the **Permissions** tab, attach a least-privilege policy if the members still need some permissions. 4. Select **AdministratorAccess** and choose **Remove**. 5. Confirm the removal. **CLI:** Detach the AdministratorAccess policy from the group: aws iam detach-group-policy --group-name --policy-arn arn:aws:iam::aws:policy/AdministratorAccess Attach a least-privilege policy if the members still need some permissions: aws iam attach-group-policy --group-name --policy-arn **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the IAM console and select **User groups**, then the group. 3. On the **Permissions** tab, choose **Add permissions**, then **Attach policies**. 4. Select **AdministratorAccess** and choose **Attach policies**. **CLI:** aws iam attach-group-policy --group-name --policy-arn arn:aws:iam::aws:policy/AdministratorAccess Note: rolling back gives every member of the group full administrative access again. Use it only as a temporary measure. **Reference** - [https://docs.aws.amazon.com/IAM/latest/UserGuide/id\_groups\_manage.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups_manage.html) - [https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) - [https://docs.aws.amazon.com/cli/latest/reference/iam/detach-group-policy.html](https://docs.aws.amazon.com/cli/latest/reference/iam/detach-group-policy.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.