AWS IAM user should not have the 'AdministratorAccess' policy attached

Docs > Datadog Security > OOTB Rules > AWS IAM user should not have the 'AdministratorAccess' policy attached

Description

Confirm there are no Amazon IAM users (privileged users) with administrator permissions for your AWS account.

Rationale

A privileged IAM user can access all AWS services and control resources through the AdministratorAccess IAM managed policy. Any user with administrator access that should not have access can potentially, whether unknowingly or purposefully, cause security issues or data leaks.

Remediation

From the console

Follow the Removing a permissions policy from a user docs to revoke AdministratorAccess for a user.

From the command line

Run list-users to get a list of current IAM users.
```
aws iam list-users
```
Run the list-user-policies command find the users attached policies.
```
 aws iam list-user-policies --user-name Name
```

Run the detach-user-policy command to revoke Administrator access.

 aws iam detach-user-policy \
 --user-name insert-username-here \
 --policy-arn insert-policy-arn-here