Policy Packs

guardrails-samples

Enforce policies to not have administrative access minimizes the risk of unauthorized access and potential misuse of administrative capabilities.

Enforce AWS IAM Policies Do Not Have Admin Privileges

main

aws_iam_policy_statements_approved

Configure IAM Policy Statements checking. This policy defines whether to verify the&#92;npolicy statements are approved, as well as the subsequent action to take on unapproved&#92;nstatements.&#92;n&#92;nRules for all Approved policies will be compiled in Approved &gt; Compiled Rules&#92;nand then evaluated. If set to &quot;Enforce: Delete unapproved&quot;, any unapproved statements&#92;nwill be removed from the policy.&#92;n

statementsApproved

AWS > IAM > Policy > Statements > Approved

aws_iam_policy_statements_approved_admin_access

If set to &quot;Disabled&quot;, IAM Policy statements that allow any action (&#39;*&#39;) on any resource (&#39;*&#39;) will be unapproved.&#92;n

statementsApprovedAdminAccess

AWS > IAM > Policy > Statements > Approved > Administrator Access

turbot_policy_setting.aws_iam_policy_statements_approved

turbot_policy_setting.aws_iam_policy_statements_approved_admin_access

Policy	Setting	Note
AWS > IAM > Policy > Statements > Approved	Check: Approved
AWS > IAM > Policy > Statements > Approved > Administrator Access	Disabled: Disallow Administrator Access (':') policies

Policy Settings