Ensure customer-managed IAM policies do not grant full administrative access

Framework Reference: A.8.2 (Privileged Access Rights) Integration: AWS โ€“ IAM

Why this matters

Granting broad administrative permissions through custom IAM policies contradicts the principle of least privilege. Policies with "Action": "*" and "Resource": "*" effectively give unrestricted access, increasing the risk of accidental misconfigurations or exploitation by compromised credentials.

Auto Checks help surface such overly permissive policies and make it easier to tighten access based on actual operational requirements.


What this check does

This check identifies any customer-managed IAM policies that allow full administrative access across all resources.

It flags policies that:

Use "Effect": "Allow"

Combine "Action": "*" with "Resource": "*"

This check focuses only on custom-defined (not AWS-managed) policies.


How to fix it

From the AWS Console

Sign in to the IAM Console

In the left menu, select Policies

Search for policies with administrative patterns (e.g., "admin", "fullaccess") or inspect those flagged by the check

Click into a policy and open the Policy Summary

If you see "*" under actions and resources:

Detach the policy from any users, groups, or roles

Delete or rewrite the policy to only allow the necessary actions

From the AWS CLI

# List where a specific policy is attached aws iam list-entities-for-policy --policy-arn <policy_arn> # Detach from a user aws iam detach-user-policy --user-name <user_name> --policy-arn <policy_arn> # Detach from a group aws iam detach-group-policy --group-name <group_name> --policy-arn <policy_arn> # Detach from a role aws iam detach-role-policy --role-name <role_name> --policy-arn <policy_arn>

You can use policy simulation tools in AWS IAM to test if a revised policy meets all required permissions without granting more than needed.


Exceptions

In specific operational contexts (such as break-glass or emergency roles), broader permissions may be temporarily allowed. These roles must:

  • Be monitored
  • Be protected with MFA
  • Be documented with use-case justification
  • Have alerts set for any usage

Further Resources

IAM Policy Best Practices

Custom vs. Managed Policies

AWS IAM CLI Reference

Was this article helpful?