IAM users should not have the 'AdministratorAccess' policy attached

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Confirm there are no Amazon IAM users (privileged users) with administrator permissions for your AWS account.

Rationale

A privileged IAM user can access all AWS services and control resources through the AdministratorAccess IAM managed policy. Any user with administrator access that should not have access can potentially, whether unknowingly or purposefully, cause security issues or data leaks.

Remediation

From the console

Follow the Removing a permissions policy from a user docs to revoke AdministratorAccess for a user.

From the command line

  1. Run list-users to get a list of current IAM users.

    aws iam list-users
    
  2. Run the list-user-policies command find the users attached policies.

     aws iam list-user-policies --user-name Name
    
  3. Run the detach-user-policy command to revoke Administrator access.

     aws iam detach-user-policy \
     --user-name insert-username-here \
     --policy-arn insert-policy-arn-here