Ensure IAM policies that allow full "*:*" administrative privileges are not attached

From Console

Perform the following action to detach the policy that has full administrative privileges:

1. Sign into the AWS console and open the IAM Dashboard.
2. In the left navigation pane, click Policies and then search for the policy name having administrative privileges.
3. Select the policy that needs to be detached. Go to Policy usage tab.
4. Select all Users, Groups, Roles that have this policy attached.
5. Click Detach. It will ask for re-confirmation.
6. Click Detach again.

Repeat the above steps for all the policies having administrative privileges.

From Command Line

List the affected entities for the policy you want to detach:

aws iam list-entities-for-policy \
  --policy-arn {{manual.policyArn}}

Use the command that matches the affected asset type shown in the alert:

Detach from an IAM User:

aws iam detach-user-policy \
  --user-name {{asset.name}} \
  --policy-arn {{manual.policyArn}}

Detach from an IAM Group:

aws iam detach-group-policy \
  --group-name {{asset.name}} \
  --policy-arn {{manual.policyArn}}

Detach from an IAM Role:

aws iam detach-role-policy \
  --role-name {{asset.name}} \
  --policy-arn {{manual.policyArn}}

Multiple Remediation Paths

AWS

SERVICE-WIDE (RECOMMENDED when many resources are affected): Deploy centralized guardrails and remediation using AWS Config Conformance Packs and (if applicable) AWS Organizations SCPs.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

ASSET-LEVEL: Apply the resource-specific remediation steps above to only the affected assets.

PREVENTIVE: Add CI/CD policy checks (CloudFormation/Terraform validation) before deployment to prevent recurrence.

References for Service-Wide Patterns

• AWS Config Conformance Packs: https://docs.aws.amazon.com/config/latest/developerguide/conformance-packs.html
• AWS Organizations SCP examples: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

• AWS: deploy/adjust organization conformance packs and policy guardrails.

aws configservice put-organization-conformance-pack --organization-conformance-pack-name <pack-name> --template-s3-uri s3://<bucket>/<template>.yaml

2. Remediate Existing Affected Assets

• Execute the control-specific Console/CLI steps documented above for each flagged resource.
• Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

• Re-scan after each remediation batch.
• Track exceptions with owner and expiry date.
• Add preventive checks in IaC/CI pipelines.