# AWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-iam-policy-no-admin-access

Recipe id: `config-iam-policy-no-admin-access` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-ELP`
- control `ac-6`

## Collection

Kind: `config-rule`

```sh
# iam-policy-no-statements-with-admin-access
aws configservice get-compliance-details-by-config-rule --config-rule-name iam-policy-no-statements-with-admin-access --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# iam-policy-no-statements-with-admin-access-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names iam-policy-no-statements-with-admin-access
```

## Expected output

EvaluationResults array; empty NON_COMPLIANT set means no evaluated customer-managed policy allows Action:* over Resource:*. Managed rule identifier: IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"iam-policy-no-statements-with-admin-access.EvaluationResults","op":"count_eq","value":0,"controls":["ac-6"],"description":"No evaluated customer-managed policy allows Action:* on Resource:*."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["ac-6"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"iam-policy-no-statements-with-admin-access-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["ac-6"],"description":"iam-policy-no-statements-with-admin-access has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"iam-policy-no-statements-with-admin-access-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["ac-6"],"description":"iam-policy-no-statements-with-admin-access has a successful evaluation on record."}

## GovCloud

AWS Config and this managed rule are available in AWS GovCloud (US); policy ARNs use partition arn:aws-us-gov

## Notes

Scope caveat: this rule evaluates only customer-managed policies, not inline or AWS-managed policies. Combine with iam-account-authorization-details review to cover inline policies and admin AWS-managed policy attachments (e.g. AdministratorAccess). A human closes that gap by reading iam-account-authorization-details, which is why this is partial; and nothing in the output records the explicit authorizations AC-06 (01) asks for or partitions privileged from non-privileged users as AC-06 (10) does, so neither enhancement is claimed.

## References

- {"title":"AWS Config managed rule: iam-policy-no-statements-with-admin-access (IAM_POLICY_NO_STATEMENTS_WITH_ADMIN_ACCESS — customer-managed policies only, not inline or AWS-managed)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-policy-no-statements-with-admin-access.html"}
- {"title":"Managed policies and inline policies","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"}