Back to Checks
aws

IAM user does not have AdministratorAccess policy attached

iam_user_administrator_access_policy
Service: iamSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsIamUser

IAM users are evaluated for a direct attachment of the AWS managed policy AdministratorAccess. The finding identifies identities where this policy appears among the user's attached policies.

Prowler logoProwlerprowler-provider-aws

Risk

Assigning an IAM user full admin rights concentrates power in long-lived credentials. If compromised, attackers gain:

  • Confidentiality: read/export all data
  • Integrity: change configs, policies, code
  • Availability: delete resources, disrupt services Also enables persistence and uncontrolled spend.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks iam_user_administrator_access_policy

Recommendation

Remove direct AdministratorAccess from users.

  • Apply least privilege with scoped policies
  • Use federation and roles for temporary admin access
  • Enforce separation of duties and approvals
  • Add guardrails (SCPs, permissions boundaries)
  • Require MFA and rotate any remaining long-lived credentials

Remediation

CLI

aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

NativeIaC

# CloudFormation: ensure IAM user does NOT have AdministratorAccess attached
Resources:
  <example_resource_name>:
    Type: AWS::IAM::User
    Properties:
      ManagedPolicyArns: []  # Critical: empty list ensures 'AdministratorAccess' is NOT attached to this user

Other

1Sign in to the AWS Console and open IAM
2Go to Users and select the target user
3Open the Permissions tab
4In Attached policies (or Permissions policies), find AdministratorAccess
5Select it and click Detach policy (or Remove)
6Confirm to detach

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.iam.iam_client import iam_client


class iam_user_administrator_access_policy(Check):
    def execute(self) -> List[Check_Report_AWS]:
        findings = []
        for user in iam_client.users:
            report = Check_Report_AWS(metadata=self.metadata(), resource=user)
            report.region = iam_client.region
            report.status = "PASS"
            report.status_extended = (
                f"IAM User {user.name} does not have AdministratorAccess policy."
            )
            for policy in user.attached_policies:
                if policy["PolicyName"] == "AdministratorAccess":
                    report.status = "FAIL"
                    report.status_extended = (
                        f"IAM User {user.name} has AdministratorAccess policy attached."
                    )
                    break

            findings.append(report)

        return findings

References