Back to Checks
aws

IAM group does not have AdministratorAccess policy attached

iam_group_administrator_access_policy
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamGroup

IAM groups are assessed for the AWS-managed AdministratorAccess policy attachment.

The finding reports any group that has this policy among its attached permissions.

Prowler logoProwlerprowler-provider-aws

Risk

Group-wide AdministratorAccess gives all members unrestricted control. A stolen or misused account can:

  • Read/exfiltrate sensitive data (C)
  • Modify or delete resources and configs (I/A)
  • Disable logging and weaken defenses, enabling persistence and lateral movement

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_group_administrator_access_policy

Recommendation

Remove AdministratorAccess from groups. Apply least privilege with task-scoped, customer-managed policies and separation of duties. Use roles for admin tasks with MFA, time-bound elevation, and auditing. Regularly review group membership and permissions; prefer defense-in-depth guardrails.

Remediation

CLI

aws iam detach-group-policy --group-name <groupname> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Terraform

# IAM group with no AdministratorAccess attachment
resource "aws_iam_group" "<example_resource_name>" {
  name = "<example_resource_name>"
  # Critical: do NOT create any aws_iam_group_policy_attachment with
  # policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess" for this group
}

NativeIaC

# CloudFormation: IAM group without AdministratorAccess attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Group
    Properties:
      GroupName: <example_resource_name>
      ManagedPolicyArns: []  # Critical: empty list ensures AdministratorAccess is NOT attached to the group

Other

1In the AWS Console, go to IAM > User groups
2Select the target group (<groupname>)
3Open the Permissions tab > Attached policies
4Select the policy AdministratorAccess and click Detach
5Confirm to remove the policy

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_group_administrator_access_policy(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        for group in iam_client.groups:
            report = Check_Report_AWS(metadata=self.metadata(), resource=group)
            report.region = iam_client.region
            report.status = "PASS"
            report.status_extended = (
                f"IAM Group {group.name} does not have AdministratorAccess policy."
            )
            for policy in group.attached_policies:
                if policy["PolicyName"] == "AdministratorAccess":
                    report.status = "FAIL"
                    report.status_extended = f"IAM Group {group.name} has AdministratorAccess policy attached."
                    break

            findings.append(report)

        return findings

References