Inline IAM policy does not allow '*:*' administrative privileges
iam_inline_policy_no_administrative_privileges
IAM inline policies on identities are evaluated for statements allowing Action:"*" on Resource:"*", which indicates unrestricted administrative access.
Risk
Granting *:* to an identity collapses least privilege, enabling total control over AWS. A compromised principal can exfiltrate data (confidentiality), alter configs or disable logging (integrity), and delete resources or keys (availability), enabling rapid lateral movement and persistent takeover.
prowler aws --checks iam_inline_policy_no_administrative_privileges
Recommendation
Remove Action:"*" with Resource:"*" from inline policies. Apply least privilege with granular actions scoped to specific resources and conditions. Prefer versioned customer-managed policies over broad inline ones, enforce separation of duties, and use permissions boundaries or guardrails to prevent accidental admin grants.
Remediation
- In the AWS Console, open IAM
- Go to Users, Roles, or Groups (whichever has the inline policy)
- Select the entity, then open the Inline policies section
- Edit the inline policy JSON and remove any statement with "Effect": "Allow" and both "Action": "" and "Resource": ""
- Replace it with only the specific actions and specific resource ARNs required
- Save changes
Source Code
Resource Type
AwsIamPolicy