A penetration tester is performing an IAM misconfiguration assessment in an AWS environment and discovers that an IAM user has the policy `AdministratorAccess` attached directly. Why is this a significant security finding?

Question

Accepted Answer

B. It grants full access to all AWS services and resources, violating the principle of least privilege. Attaching the `AdministratorAccess` policy to an IAM user grants that user unrestricted access to all AWS services and resources. This violates the principle of least privilege, which requires users to have only the minimum permissions necessary for their role. If the account is compromised, the attacker inherits full administrative control over the entire AWS environment.

A penetration tester is performing an IAM misconfiguration assessment in an AWS environment and discovers that an IAM user has the policy `AdministratorAccess` attached directly. Why is this a significant security finding?

Related Questions

Discussion

A penetration tester is performing an IAM misconfiguration assessment in an AWS environment and discovers that an IAM user has the policy AdministratorAccess attached directly. Why is this a significant security finding?

Related Questions

Discussion

A penetration tester is performing an IAM misconfiguration assessment in an AWS environment and discovers that an IAM user has the policy `AdministratorAccess` attached directly. Why is this a significant security finding?