IAM privileged user has admin permissions for your AWS account
Incident Management is now generally available! Incident Management is now generally available!
<  Back to rules search

IAM privileged user has admin permissions for your AWS account

iam

Classification:

compliance

Overview

Description

Confirm there are no Amazon IAM users (privileged users) with administrator permissions for your AWS account.

Rationale

A privileged IAM user can access all AWS services and control resources through the AdministratorAccess IAM managed policy. Any user with administrator access that should not have access can potentially, whether unknowingly or purposefully, cause security issues or data leaks.

Remediation

Console

Follow the Removing a permissions policy from a user docs to revoke AdministratorAccess for a user.

CLI

  1. Run list-users to get a list of current IAM users.

  2. Run list-user-policies with an IAM user-name to find the users attached policies.

    list-attached-user-policies.sh

        aws iam list-user-policies --user-name Name
        
  3. Run detach-user-policy to revoke Administrator access for that user.

    list-attached-user-policies.sh

        aws iam detach-user-policy --user-name Bob --policy-arn arn:aws:iam::123456789012:policy/TesterPolicy