Help Center
Go back to application
Help Center
Go back to application
Platform Terms Glossary
Task Management
Task Management explained Creating Tasks Setting up Task NotificationsGiving permissions to team members
Organization
Working together in KertosInviting UsersCreating rolesAssigning System AccessCreating Departments and Assigning Users
Integrations
Discovery
Tasks
Device Management
Human Resource Information Systems
Inventory
Inventorization of vendorsInventorization of systemsInventorization of assetsEU AI Act: Inventorization of AI use cases
Risks
Managing risksApplying controls to risks
Trust Center
Setting up your trust center
Incidents
Reporting incidents
KAIA
KAIA explainedPrinciples of AI at Kertos
Interacting with KAIA
Compliance
Frameworks explainedManaging & implementing controlsCreating & managing policiesCompleting & assigning trainings
Privacy Management
Creating a RoPACreating TOMsCreating DPIAs
Data Subject Requests
API Reference
Ingress API Docs for DSRs Webhook API Docs for DSRs
Auto Checks
Auto Checks explained
Auto Checks Detailed Explanation
Enforce MFA on the AWS Root AccountVerify CloudTrail is logging management events across all AWS regionsEnsure no IAM AWS-managed policies grant full administrative accessConfirm that Amazon GuardDuty is enabled for threat detectionEnsure the root account does not have any active access keysConfirm IAM Access Analyzer is enabled to monitor access permissionsConfigure a log metric filter and alarm for unauthorized API callsConfigure a log metric filter and alarm for root account usageEnsure customer-managed IAM policies do not grant full administrative accessPrevent IAM identities from having inline policies with unrestricted accessMaintain accurate and up-to-date AWS account contact informationRegister a valid security contact in the AWS account settingsBlock IAM Inline Policies That Enable Privilege EscalationPrevent IAM Inline Policies from Granting Full CloudTrail AccessAvoid Full KMS Access in Inline IAM PoliciesPrevent Overly Permissive Role Assumption in Custom IAM PoliciesPrevent Privilege Escalation via Customer-Managed IAM PoliciesAvoid IAM Policies Granting Full CloudTrail AccessAvoid IAM Policies Granting Unrestricted KMS AccessPrevent IAM Roles from Assigning ReadOnlyAccess Permissions to External AWS AccountsProtect IAM Service Roles from Confused Deputy Attacks Using Proper Trust PoliciesAvoid Provisioning Access Keys During Initial IAM User Creation When Console Login is EnabledDetect IAM Users with Multiple Active Access Keys and Enforce Key Rotation

Ensure no IAM AWS-managed policies grant full administrative access

Framework Reference: A.8.2 (Privileged Access Rights) Integration: AWS – IAM

Why this matters

IAM (Identity and Access Management) policies define what actions users, roles, or groups can take in your AWS environment. Granting full administrative access (e.g., "Action": "*" and "Resource": "*" in combination with "Effect": "Allow") to users via AWS-managed policies contradicts the principle of least privilege.

Such broad permissions can allow accidental or malicious changes to critical systems, data leaks, and full service disruption. Using narrowly scoped, custom policies helps reduce the attack surface and prevent privilege misuse.

AWS-managed policies like AdministratorAccess should only be used in rare, tightly-controlled scenarios. Avoid using them for routine access.

What this check does

This check scans all IAM users, groups, and roles for AWS-managed policies that grant full administrative access.

The check fails if:

Any entity (user, group, or role) has an attached AWS-managed policy that provides "Action": "*" permissions.

It passes if:

No such AWS-managed admin policy is found.

How to fix it

From the AWS Console

Sign in to the IAM Console

In the left menu, go to Policies

Search for AdministratorAccess or any policy flagged in the check

Open the policy and view Attached entities

For each attached User, Group, or Role:\n - Click Detach policy

(Optional but recommended) After detaching, select the policy and click Delete to prevent future use

From the AWS CLI

# List attached entities aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess # Detach from a user aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess # Detach from a group aws iam detach-group-policy --group-name <groupname> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess # Detach from a role aws iam detach-role-policy --role-name <rolename> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Replace <username>, <groupname>, and <rolename> with the actual entity names from your environment.

Exceptions

If full administrative access is required for a break-glass or emergency account, it must be:

Clearly documented

Monitored (e.g., with CloudTrail alerts)

Not assigned to day-to-day user roles

Protected by MFA and audit logging

Further Resources

AWS IAM Best Practices

Managed vs. Inline Policies

AWS IAM CLI Reference

Was this article helpful?

Powered by Product Fruits