AdministratorAccess

Last Modified

Mar 12, 2026

March 12, 2026 at 09:27 PM UTC

Version

Total Versions

Created

Feb 6, 2015

Actions

Subscribe to updates

Risk

Critical

Administrator access, or an unrestricted way to grant itself permissions or take over other identities. Treat it as admin. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

Critical
Full administrator access
Allows every action on every resource. It covers all 92 documented privilege escalation paths by definition.
- Statement 1: Action "*" on *
Use with caution: Keep it for administrator or break-glass roles protected by MFA. Never attach it to a workload, a CI pipeline or a vendor role.
Medium
Flagged by AWS IAM Access Analyzer
AWS's own policy validation raises 1 security warning: PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE.
- Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement.
Use with caution: Read AWS's finding and the documentation it links to.

IAM Access Analyzer (2)

Warning / CREATE_SLR_WITH_STAR_IN_ACTION_AND_RESOURCE
Using wildcards (*) in the action and the resource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead. AWS docs
Security warning / PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE
Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement. AWS docs

Policy Document

View on GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "*",
          "Resource": "*"
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2015-02-06T18:39:46+00:00"
  }
}