IAM user, role, or group has a full-privilege AWS-managed policy attached (AdministratorAccess or IAMFullAccess)
What it checks
The authored attachment names AdministratorAccess or IAMFullAccess.
Where it applies
Terraform: aws_iam_user_policy_attachment, aws_iam_role_policy_attachment, aws_iam_group_policy_attachment, aws_iam_policy_attachment, aws_iam_role_policy_attachments_exclusive, aws_iam_user_policy_attachments_exclusive, aws_iam_group_policy_attachments_exclusive, aws_iam_role
CloudFormation: AWS::IAM::Role
How to fix it
- Replace AdministratorAccess with a scoped managed policy. Use AWS Access Analyzer to identify minimum required permissions from CloudTrail.
Frameworks
- SOC 2 CC6.1
These mappings are advisory, not an attestation of compliance.