Prevent IAM identities from having inline policies with unrestricted access

Framework Reference: A.8.2 (Privileged Access Rights) Integration: AWS – IAM

Why this matters

Inline IAM policies are directly attached to users, roles, or groups. Unlike managed policies, they are harder to audit and reuse, and often introduce overly broad permissions without oversight. If an inline policy grants unrestricted access using "Action": "*", it effectively gives full admin rights—violating the principle of least privilege.

This check ensures that inline policies do not introduce unnecessary risk and encourages use of managed policies for better control and visibility.


What this check does

This check evaluates all IAM users, roles, and groups with attached inline policies and verifies whether any of those policies contain:

"Effect": "Allow"

"Action": "*"

"Resource": "*"

It passes if no inline policies grant full admin access. It fails if any inline policy allows unrestricted access.


How to fix it

From the AWS Console

Sign in to the IAM Console

Go to Users, Groups, or Roles

Select each identity and scroll to the Inline Policies section

Review the inline policy document

If the policy grants "Action": "*" and "Resource": "*", click Delete

Replace it with a managed policy that only grants necessary permissions

From the AWS CLI

You can list and evaluate inline policies using these commands:

# List inline policies for a user aws iam list-user-policies --user-name <user-name> # Delete an inline policy aws iam delete-user-policy --user-name <user-name> --policy-name <policy-name>

Repeat for list-group-policies and list-role-policies if needed.


Best Practices

Prefer managed policies over inline policies for easier governance

Always design policies based on specific job functions

Use policy simulation tools to test for over-permissioning before deployment


Exceptions

There are no widely accepted exceptions to this rule. In rare edge cases, a tightly scoped inline policy may be allowed temporarily, but this should be clearly documented and removed after use.


Further Resources

AWS IAM Best Practices

Inline vs. Managed Policies

AWS CLI IAM Commands

Was this article helpful?