Description

Identifies when administrator-level AWS IAM policies are attached to IAM entities (users, groups, roles) in Terraform configurations. This represents a security risk as it grants overly permissive access rights that violate the principle of least privilege.

Detection Strategy

• Scans Terraform resource declarations for IAM policy attachments (aws_iam_*_policy_attachment resources)

• Checks if the policy_arn attribute references known administrator policies like 'AdministratorAccess'

• Reports a vulnerability when an administrator policy is attached to any IAM user, group, or role

• Specifically monitors aws_iam_user_policy_attachment, aws_iam_group_policy_attachment, aws_iam_role_policy_attachment, and aws_iam_policy_attachment resources

Vulnerable code example

resource "aws_iam_role" "role" {
  name = "test-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole"
      Principal = {
        Service = "ec2.amazonaws.com"...

✅ Secure code example

variable "role_name" {
  description = "IAM role name"
  type        = string
  default     = "test-role"
}

resource "aws_iam_role" "role" {
  name = var.role_name...