Back to Checks
aws

IAM role does not have AdministratorAccess policy attached

iam_role_administratoraccess_policy
Service: iamSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamRole

IAM roles (excluding service roles) are evaluated for attachment of the AWS-managed AdministratorAccess policy.

Attachment indicates the role holds unrestricted permissions across services and resources.

Prowler logoProwlerprowler-provider-aws

Risk

Granting full administrative permissions on a role undermines confidentiality, integrity, and availability. If the role is assumed or its credentials are stolen, an attacker can read sensitive data, change policies, disable auditing, delete resources and backups, and create new privileged identities, enabling swift account takeover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_role_administratoraccess_policy

Recommendation

Apply least privilege: avoid attaching AdministratorAccess to roles. Grant only task-scoped permissions with custom policies and enforce separation of duties.

Use permissions boundaries, SCPs, and policy conditions to constrain power. Require MFA for break-glass admins, time-bound elevation with approval, and refine access using Access Analyzer.

Remediation

CLI

aws iam detach-role-policy --role-name <ROLE_NAME> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Terraform

# IAM Role without AdministratorAccess
resource "aws_iam_role" "<example_resource_name>" {
  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "ec2.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}
POLICY

  managed_policy_arns = [] # Critical: ensures "AdministratorAccess" is NOT attached
}

NativeIaC

# CloudFormation: IAM Role without AdministratorAccess
Resources:
  <example_resource_name>:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns: []  # Critical: ensure AdministratorAccess is NOT attached to this role

Other

1In the AWS Console, go to IAM > Roles
2Select the role flagged by the check
3On the Permissions tab, under Attached policies, find "AdministratorAccess"
4Click Detach next to "AdministratorAccess"
5Confirm the detach

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_role_administratoraccess_policy(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []
        if iam_client.roles:
            for role in iam_client.roles:
                if (
                    not role.is_service_role
                ):  # Avoid service roles since they cannot be modified by the user
                    report = Check_Report_AWS(metadata=self.metadata(), resource=role)
                    report.region = iam_client.region
                    report.status = "PASS"
                    report.status_extended = f"IAM Role {role.name} does not have AdministratorAccess policy."
                    for policy in role.attached_policies:
                        if policy["PolicyName"] == "AdministratorAccess":
                            report.status_extended = f"IAM Role {role.name} has AdministratorAccess policy attached."
                            report.status = "FAIL"

                    findings.append(report)

        return findings

References