Description

Detects when powerful administrative IAM policies (AdministratorAccess, PowerUserAccess, or IAMFullAccess) are actively attached to identities in AWS. These highly privileged policies grant extensive permissions that violate the principle of least privilege and could lead to account compromise if misused.

Detection Strategy

• Scans all IAM policies in the AWS account for specific administrative policy ARNs: AdministratorAccess, PowerUserAccess, and IAMFullAccess

• Checks if these powerful policies have a non-zero attachment count, indicating they are actively being used

• Verifies the policy is currently attached to at least one IAM user, role, or group

• Reports a vulnerability if any of these admin policies are found to be actively attached to identities