EC2 instance has an IAM role with admin privileges

Severity: High
Service: EC2
Check ID: EC2_INSTANCE_PROFILE_ADMIN

What this check finds

The instance profile attached to this EC2 instance grants full administrator access (AdministratorAccess policy or equivalent wildcard permissions). If the instance is compromised via SSRF, RCE, or a malicious workload, an attacker can retrieve credentials from the metadata service and assume the role, gaining unrestricted access to the AWS account.

Passing looks like: No EC2 instance role with admin privileges.

How to fix it

Replace the AdministratorAccess policy with a least-privilege policy scoped to only the actions and resources the instance actually needs.

AWS CLI

aws iam detach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Then attach a scoped replacement policy.

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

IAM → Roles → select role → Permissions → detach AdministratorAccess.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to EC2 instance has an IAM role with admin privileges
Framework	Controls
PCI-DSS v4.0.1	7.2 Access to system components and data is appropriately defined and assigned
HIPAA Security Rule	164.308(a)(3) Workforce Security — Access Authorization
SOC 2 — Trust Services Criteria	CC6.2 Role-Based Access Control
NIST SP 800-53 Rev5 (Moderate)	AC-6 Least Privilege
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.8.2 Privileged access rights

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More EC2 checks

All EC2 checks