IAMFullAccess

Last Modified

Mar 12, 2026

March 12, 2026 at 09:28 PM UTC

Version

Total Versions

Created

Jun 21, 2019

Actions

Subscribe to updates

Risk

Critical

Administrator access, or an unrestricted way to grant itself permissions or take over other identities. Treat it as admin. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

Critical
Can grant itself more permissions
Grants every action of 8 documented escalation paths on any resource with no condition.
- iam-001iam:CreatePolicyVersionunrestricted
- iam-005iam:PutRolePolicyunrestricted
- iam-007iam:PutUserPolicyunrestricted
- iam-008iam:AttachUserPolicyunrestricted
- iam-009iam:AttachRolePolicyunrestricted
- iam-010iam:AttachGroupPolicyunrestricted
- iam-011iam:PutGroupPolicyunrestricted
- iam-013iam:AddUserToGroupunrestricted
Use with caution: Treat it as administrator access. If it must be used, add a permissions boundary that denies IAM policy writes on your own roles and users.
Critical
Can take over other users or roles
Grants every action of 10 documented escalation paths on any resource with no condition.
- iam-002iam:CreateAccessKeyunrestricted
- iam-003iam:CreateAccessKey + iam:DeleteAccessKeyunrestricted
- iam-004iam:CreateLoginProfileunrestricted
- iam-006iam:UpdateLoginProfileunrestricted
- iam-012iam:UpdateAssumeRolePolicyunrestricted
- iam-015iam:AttachUserPolicy + iam:CreateAccessKeyunrestricted
- iam-018iam:PutUserPolicy + iam:CreateAccessKeyunrestricted
- iam-019iam:AttachRolePolicy + iam:UpdateAssumeRolePolicyunrestricted
2 more paths
- iam-020iam:CreatePolicyVersion + iam:UpdateAssumeRolePolicyunrestricted
- iam-021iam:PutRolePolicy + iam:UpdateAssumeRolePolicyunrestricted
Use with caution: Reserve it for identity administrators. Keep role trust policies narrow, since sts:AssumeRole on every role is only as safe as the roles that trust the account.
High
Can change identities and their permissions
Grants 77 permissions management actions on IAM, IAM Identity Center or Organizations, on any resource with no condition.
iam:addclientidtoopenidconnectprovideriam:addroletoinstanceprofileiam:addusertogroupiam:attachgrouppolicyiam:attachrolepolicyiam:attachuserpolicyiam:changepasswordiam:createaccesskeyiam:createaccountaliasiam:creategroupiam:createinstanceprofileiam:createloginprofileand 65 more
Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.
Medium
Full iam access on every resource
Uses iam:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
iam:*
Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Medium
Flagged by AWS IAM Access Analyzer
AWS's own policy validation raises 1 security warning: PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE.
- Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement.
Use with caution: Read AWS's finding and the documentation it links to.

IAM Access Analyzer (2)

Warning / CREATE_SLR_WITH_STAR_IN_ACTION_AND_RESOURCE
Using wildcards (*) in the action and the resource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead. AWS docs
Security warning / PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE
Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement. AWS docs

Policy Document

View on GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "iam:*",
            "organizations:DescribeAccount",
            "organizations:DescribeOrganization",
            "organizations:DescribeOrganizationalUnit",
            "organizations:DescribePolicy",
            "organizations:ListChildren",
            "organizations:ListParents",
            "organizations:ListPoliciesForTarget",
            "organizations:ListRoots",
            "organizations:ListPolicies",
            "organizations:ListTargetsForPolicy"
          ],
          "Resource": "*"
        }
      ]
    },
    "VersionId": "v2",
    "IsDefaultVersion": true,
    "CreateDate": "2019-06-21T19:40:00+00:00"
  }
}

Version History (10 recorded)

Raw history

v2updated

scope changed, no action added or removed

Mar 12, 2026

ad405ff

Update detected