Unattached customer managed IAM policy does not allow '*:*' administrative privileges
iam_customer_unattached_policy_no_administrative_privileges
Customer-managed IAM policies that are unattached are evaluated for statements granting full administrative access using *:* wildcards.
The focus is on policies whose documents include unrestricted actions on all resources.
Risk
An unattached policy with *:* can be attached accidentally or maliciously, granting account-wide control. Attackers could read sensitive data (confidentiality), alter or delete resources (integrity), and disrupt services (availability), enabling rapid privilege escalation and lateral movement.
prowler aws --checks iam_customer_unattached_policy_no_administrative_privileges
Recommendation
Remove or redesign these policies to enforce least privilege:
- Avoid
*in actions/resources; scope precisely and use conditions - Apply permissions boundaries and SCPs as guardrails
- Require peer review and policy validation before attachment
- Use analysis tools to refine permissions and delete unused policies
Remediation
aws iam create-policy-version --policy-arn <example_resource_arn> --set-as-default --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"iam:GetAccountSummary","Resource":"*"}]}'
- In the AWS Console, go to IAM > Policies
- Find the unattached customer managed policy and choose it
- Click Edit policy > JSON
- Remove any statement that allows Action "" on Resource "", or replace it with a specific action (e.g., "iam:GetAccountSummary")
- Save changes
Source Code
Resource Type
AwsIamPolicy