Description

Detects when AWS CloudFormation templates grant excessive administrative privileges by attaching administrator policies to IAM entities. This creates security risks by violating the principle of least privilege, potentially allowing users or roles to perform unauthorized actions across AWS services.

Detection Strategy

• Scan CloudFormation template files for IAM resource definitions (AWS::IAM::User, AWS::IAM::Role, or AWS::IAM::Group)

• Check if these IAM entities have policies attached that grant administrator privileges

• Analyze policy documents to identify overly permissive administrative access (like '*' permissions or admin policy attachments)

• Report a vulnerability when an IAM entity is configured with administrative privileges

Vulnerable code example

Resources:
  RiskyRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess  # Dangerous: Grants full admin access...

✅ Secure code example

Resources:
  RestrictedRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow...