Guide · Cybersecurity
Why Admin Access Is Dangerous in AWS
Admin access in AWS means one compromised key can delete everything. Here's why and how to fix it.
Broad admin roles conflict with least-privilege expectations for production AI. Primary control: Authorization
Blast radius is the whole account
`AdministratorAccess` (and "temporary" full-admin users) means one phished laptop or leaked CI key can delete data, rewrite IAM, or open a billing firehose. A startup that shared one admin IAM user across engineers and CI learned that the hard way: after phishing, every database, bucket, and role was in scope. Rotation alone didn't restore trust—least privilege would have confined the blast to one service.
SOC 2, ISO 27001, and serious buyers treat unbounded IAM as a finding, not a convenience.
Shrink privileges before you need forensics
- One role per workload (`lambda-api-role` that can invoke that function and read one bucket—not ``).
- Prefer named actions and ARNs over `s3:` on ``.
- Conditions (MFA, source IP/VPC, tags) where humans assume roles.
- No shared root/admin persona; humans assume roles; CI gets its own constrained role.
- Quarterly Access Analyzer + unused-permission cleanup.
Admin is for break-glass only
Keep a tightly controlled break-glass path with MFA and logging—not day-to-day deploys. APRF Authorization and Infrastructure expect least privilege as a gate: prove who can do what, and that "admin" isn't the default path.
Next: Authorization
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- Why is admin access dangerous in AWS?
- Admin access grants full control over your AWS account. One compromised key can delete resources, exfiltrate data, or rack up bills. Use least privilege to limit blast radius.
- What is least privilege in AWS?
- Least privilege means granting each role or user only the permissions it needs—no more. Create separate roles per service with minimal permissions.
- How do I reduce admin access in AWS?
- Create custom roles per service. Use IAM Access Analyzer to find overly permissive policies. Remove unused permissions. Never use shared admin credentials.