Back to Checks
aws

Inline IAM policy does not allow '*:*' administrative privileges

iam_inline_policy_no_administrative_privileges
Service: iamSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamPolicy

IAM inline policies on identities are evaluated for statements allowing Action:"*" on Resource:"*", which indicates unrestricted administrative access.

Prowler logoProwlerprowler-provider-aws

Risk

Granting *:* to an identity collapses least privilege, enabling total control over AWS. A compromised principal can exfiltrate data (confidentiality), alter configs or disable logging (integrity), and delete resources or keys (availability), enabling rapid lateral movement and persistent takeover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_inline_policy_no_administrative_privileges

Recommendation

Remove Action:"*" with Resource:"*" from inline policies. Apply least privilege with granular actions scoped to specific resources and conditions. Prefer versioned customer-managed policies over broad inline ones, enforce separation of duties, and use permissions boundaries or guardrails to prevent accidental admin grants.

Remediation

Terraform

# Terraform: Inline role policy without '*:*' privileges
resource "aws_iam_role_policy" "<example_resource_name>" {
  name = "leastpriv"
  role = "<example_resource_name>"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:ListBucket"                   # Critical: specific action, not "*"
      Resource = "arn:aws:s3:::<example_resource_name>"  # Critical: specific resource, not "*"
    }]
  })
}

NativeIaC

# CloudFormation: Inline policy without '*:*' privileges
Resources:
  <example_resource_name>Policy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: leastpriv
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: s3:ListBucket        # Critical: specific action, not "*"
            Resource: arn:aws:s3:::<example_resource_name>  # Critical: specific resource, not "*"
      Roles:
        - <example_resource_name>

Other

1In the AWS Console, open IAM
2Go to Users, Roles, or Groups (whichever has the inline policy)
3Select the entity, then open the Inline policies section
4Edit the inline policy JSON and remove any statement with "Effect": "Allow" and both "Action": "*" and "Resource": "*"
5Replace it with only the specific actions and specific resource ARNs required
6Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client
from prowler.providers.aws.services.iam.lib.policy import check_admin_access


class iam_inline_policy_no_administrative_privileges(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        for policy in iam_client.policies.values():
            if policy.type == "Inline":
                report = Check_Report_AWS(metadata=self.metadata(), resource=policy)
                report.region = iam_client.region
                report.resource_id = f"{policy.entity}/{policy.name}"
                report.status = "PASS"

                resource_type_str = report.resource_arn.split(":")[-1].split("/")[0]
                resource_attached = report.resource_arn.split("/")[-1]

                report.status_extended = f"{policy.type} policy {policy.name} attached to {resource_type_str} {resource_attached} does not allow '*:*' administrative privileges."
                if policy.document and check_admin_access(policy.document):
                    report.status = "FAIL"
                    report.status_extended = f"{policy.type} policy {policy.name} attached to {resource_type_str} {resource_attached} allows '*:*' administrative privileges."
                findings.append(report)
        return findings

References