Find IAM Policies That Grant Admin Access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadIamPolicies",
      "Effect": "Allow",
      "Action": [
        "iam:ListPolicies",
        "iam:GetPolicyVersion",
        "iam:ListEntitiesForPolicy",
        "iam:ListUsers",
        "iam:ListUserPolicies",
        "iam:GetUserPolicy",
        "iam:ListGroups",
        "iam:ListGroupPolicies",
        "iam:GetGroupPolicy",
        "iam:ListRoles",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy"
      ],
      "Resource": "*"
    }
  ]
}

// find-iam-policies-with-admin-access.ts
// Finds IAM policies that grant administrator-level access: customer managed policies (default version),
// inline policies on users, groups and roles, and attachments of the AWS managed AdministratorAccess policy.
// Flags Allow statements with Action "*" on Resource "*", NotAction on Resource "*", and "iam:*" on "*".
// Report-only: it never changes a policy.
// Usage: npx tsx find-iam-policies-with-admin-access.ts [--include-unattached]
import {
  IAMClient,
  GetGroupPolicyCommand,
  GetPolicyVersionCommand,
  GetRolePolicyCommand,
  GetUserPolicyCommand,
  paginateListEntitiesForPolicy,
  paginateListGroupPolicies,
  paginateListGroups,
  paginateListPolicies,
  paginateListRolePolicies,
  paginateListRoles,
  paginateListUserPolicies,
  paginateListUsers,
} from "@aws-sdk/client-iam";

const iam = new IAMClient({ region: "us-east-1" }); // IAM is global in the aws partition; any commercial Region works
const includeUnattached = process.argv.includes("--include-unattached");
const ADMIN_ARN = "arn:aws:iam::aws:policy/AdministratorAccess";

interface Statement {
  Effect?: string;
  Action?: string | string[];
  NotAction?: string | string[];
  Resource?: string | string[];
  NotResource?: string | string[];
  Condition?: Record<string, unknown>;
}
interface Finding { Source: string; Policy: string; AttachedTo: string; Finding: string }

const list = (v: string | string[] | undefined): string[] => (v === undefined ? [] : Array.isArray(v) ? v : [v]);

// IAM returns policy documents URL-encoded (RFC 3986); the JavaScript SDK doesn't decode them for you.
function parseDocument(raw: string | undefined): Statement[] {
  if (!raw) return [];
  let text = raw;
  try { text = decodeURIComponent(raw); } catch { /* already plain JSON */ }
  const doc = JSON.parse(text) as { Statement?: Statement | Statement[] };
  return doc.Statement === undefined ? [] : Array.isArray(doc.Statement) ? doc.Statement : [doc.Statement];
}

function classify(statements: Statement[]): string[] {
  const out: string[] = [];
  for (const s of statements) {
    if (s.Effect !== "Allow") continue;
    const onEverything = list(s.Resource).includes("*") || s.NotResource !== undefined;
    if (!onEverything) continue;
    const conditional = s.Condition ? " (with Condition)" : "";
    const actions = list(s.Action).map((a) => a.toLowerCase());
    if (actions.includes("*") || actions.includes("*:*")) out.push(`FULL ADMIN: Action * on Resource *${conditional}`);
    else if (s.NotAction !== undefined) out.push(`NEAR ADMIN: NotAction [${list(s.NotAction).join(", ")}] on Resource *${conditional}`);
    else if (actions.includes("iam:*")) out.push(`PRIVILEGE ESCALATION: iam:* on Resource *${conditional}`);
  }
  return out;
}

async function main(): Promise<void> {
  const findings: Finding[] = [];

  // 1. Customer managed policies used as permissions policies, default version only (the one in effect).
  //    Permissions boundaries only cap access, so a boundary with Action "*" is not a finding.
  const policyFilter = { Scope: "Local", OnlyAttached: !includeUnattached, PolicyUsageFilter: "PermissionsPolicy" } as const;
  for await (const page of paginateListPolicies({ client: iam }, policyFilter)) {
    for (const p of page.Policies ?? []) {
      if (!p.Arn || !p.DefaultVersionId) continue;
      const v = await iam.send(new GetPolicyVersionCommand({ PolicyArn: p.Arn, VersionId: p.DefaultVersionId }));
      for (const f of classify(parseDocument(v.PolicyVersion?.Document))) {
        findings.push({ Source: "managed", Policy: p.PolicyName ?? p.Arn, AttachedTo: `${p.AttachmentCount ?? 0} attachment(s)`, Finding: f });
      }
    }
  }

  // 2. Inline policies embedded in users, groups and roles.
  for await (const page of paginateListUsers({ client: iam }, {})) {
    for (const u of page.Users ?? []) {
      const name = u.UserName ?? "";
      for await (const names of paginateListUserPolicies({ client: iam }, { UserName: name })) {
        for (const pn of names.PolicyNames ?? []) {
          const doc = await iam.send(new GetUserPolicyCommand({ UserName: name, PolicyName: pn }));
          for (const f of classify(parseDocument(doc.PolicyDocument))) findings.push({ Source: "inline", Policy: pn, AttachedTo: `user/${name}`, Finding: f });
        }
      }
    }
  }
  for await (const page of paginateListGroups({ client: iam }, {})) {
    for (const g of page.Groups ?? []) {
      const name = g.GroupName ?? "";
      for await (const names of paginateListGroupPolicies({ client: iam }, { GroupName: name })) {
        for (const pn of names.PolicyNames ?? []) {
          const doc = await iam.send(new GetGroupPolicyCommand({ GroupName: name, PolicyName: pn }));
          for (const f of classify(parseDocument(doc.PolicyDocument))) findings.push({ Source: "inline", Policy: pn, AttachedTo: `group/${name}`, Finding: f });
        }
      }
    }
  }
  for await (const page of paginateListRoles({ client: iam }, {})) {
    for (const r of page.Roles ?? []) {
      if (r.Path?.startsWith("/aws-service-role/")) continue; // service-linked roles: permissions set by AWS
      const name = r.RoleName ?? "";
      for await (const names of paginateListRolePolicies({ client: iam }, { RoleName: name })) {
        for (const pn of names.PolicyNames ?? []) {
          const doc = await iam.send(new GetRolePolicyCommand({ RoleName: name, PolicyName: pn }));
          for (const f of classify(parseDocument(doc.PolicyDocument))) findings.push({ Source: "inline", Policy: pn, AttachedTo: `role/${name}`, Finding: f });
        }
      }
    }
  }

  // 3. Who has the AWS managed AdministratorAccess policy attached as a permissions policy.
  const adminFilter = { PolicyArn: ADMIN_ARN, PolicyUsageFilter: "PermissionsPolicy" } as const;
  for await (const page of paginateListEntitiesForPolicy({ client: iam }, adminFilter)) {
    const who = [
      ...(page.PolicyUsers ?? []).map((u) => `user/${u.UserName}`),
      ...(page.PolicyGroups ?? []).map((g) => `group/${g.GroupName}`),
      ...(page.PolicyRoles ?? []).map((r) => `role/${r.RoleName}`),
    ];
    for (const w of who) findings.push({ Source: "aws-managed", Policy: "AdministratorAccess", AttachedTo: w, Finding: "FULL ADMIN: AWS managed policy" });
  }

  console.table(findings);
  const full = findings.filter((f) => f.Finding.startsWith("FULL ADMIN")).length;
  console.log(`${findings.length} finding(s): ${full} full admin, ${findings.length - full} near-admin or escalation paths.`);
  console.log("Report only: no policy was changed.");
  if (findings.length) process.exitCode = 2;
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-iam
npm install --save-dev tsx typescript

AWS_PROFILE=security-audit npx tsx find-iam-policies-with-admin-access.ts

# Also scan customer managed policies that aren't attached to anything
AWS_PROFILE=security-audit npx tsx find-iam-policies-with-admin-access.ts --include-unattached

┌─────────┬───────────────┬───────────────────────┬──────────────────────────────────────┬────────────────────────────────────────────────────────────────┐
│ (index) │ Source        │ Policy                │ AttachedTo                           │ Finding                                                        │
├─────────┼───────────────┼───────────────────────┼──────────────────────────────────────┼────────────────────────────────────────────────────────────────┤
│ 0       │ 'managed'     │ 'ci-deploy'           │ '2 attachment(s)'                    │ 'FULL ADMIN: Action * on Resource *'                           │
│ 1       │ 'managed'     │ 'ops-break-glass'     │ '1 attachment(s)'                    │ 'FULL ADMIN: Action * on Resource * (with Condition)'          │
│ 2       │ 'managed'     │ 'platform-team'       │ '1 attachment(s)'                    │ 'NEAR ADMIN: NotAction [iam:*, organizations:*] on Resource *' │
│ 3       │ 'inline'      │ 'bootstrap'           │ 'role/legacy-jenkins'                │ 'PRIVILEGE ESCALATION: iam:* on Resource *'                    │
│ 4       │ 'inline'      │ 'temp-fix'            │ 'user/alice'                         │ 'FULL ADMIN: Action * on Resource *'                           │
│ 5       │ 'aws-managed' │ 'AdministratorAccess' │ 'group/admins'                       │ 'FULL ADMIN: AWS managed policy'                               │
│ 6       │ 'aws-managed' │ 'AdministratorAccess' │ 'role/OrganizationAccountAccessRole' │ 'FULL ADMIN: AWS managed policy'                               │
└─────────┴───────────────┴───────────────────────┴──────────────────────────────────────┴────────────────────────────────────────────────────────────────┘
7 finding(s): 5 full admin, 2 near-admin or escalation paths.
Report only: no policy was changed.