Block IAM Inline Policies That Enable Privilege Escalation

Framework Reference: A.8.2 (Identity Management) Integration: AWS – IAM

Why this matters

Inline IAM policies are attached directly to users, roles, or groups and are not reused or versioned like managed policies. This makes them harder to audit and maintain. Worse, if these policies grant overly broad permissions—such as allowing the creation of new roles or assignment of privileges—they can be exploited for privilege escalation.

Privilege escalation enables attackers to elevate their access rights in your AWS environment. This can lead to full compromise of accounts and services if not properly managed.


What this check does

This Auto Check scans all IAM inline policies for patterns that indicate potential privilege escalation, such as:

Use of wildcard actions like "Action": "*"

Permissions to modify IAM roles, policies, or access keys

Lack of conditions limiting sensitive operations

If such policies are detected, the check will fail.


How to fix it

From the AWS Console

Sign in to the IAM Console

In the navigation pane, choose Users, Roles, or Groups

For each identity, review the Inline Policies section

Open each inline policy and inspect the permissions

Look for broad statements like Effect: Allow, Action: *, or risky permissions (e.g., iam:PassRole, iam:CreatePolicy)

Delete or replace these policies with managed ones that follow least privilege principles

From the AWS CLI

You can list and detach inline policies using:

aws iam list-user-policies --user-name <user_name> aws iam delete-user-policy --user-name <user_name> --policy-name <policy_name>

Repeat similarly for groups and roles.


Best Practices

Avoid inline policies entirely if possible; use managed policies instead

Apply least privilege: grant only the permissions required for the task

Regularly audit IAM policies across all accounts and regions

Use policy conditions to limit access by IP, service, or resource


Further Resources

AWS IAM Best Practices

Managed vs Inline Policies

IAM CLI Reference

Was this article helpful?