IAM policies should not use 'Effect: Allow' with 'NotAction'

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Description

IAM policies using ‘Effect: Allow’ with ‘NotAction’ permits all actions except those explicitly denied, which can lead to unintended privilege escalation and broader access than intended. Instead, explicit permissions should be defined to enforce the principle of least privilege, ensuring users have only the access necessary for their roles.

Remediation

From the console

See the IAM JSON Policy Elements: NotAction documentation for guidance on how to modify policies. Replace ‘NotAction’ with specific actions that should be allowed and ensure your policies adhere to the principle of least privilege.