When should I attach IAMFullAccess?

The IAM User Guide describes full access policies as defining permissions for service administrators by granting full access to a service, and lists IAMFullAccess as an example. Where you need less than full IAM access, AWS recommends defining a customer managed policy specific to your use case.

What does IAMFullAccess grant?

It allows iam:* on all resources, plus these AWS Organizations actions: DescribeAccount, DescribeOrganization, DescribeOrganizationalUnit, DescribePolicy, ListChildren, ListParents, ListPoliciesForTarget, ListRoots, ListPolicies and ListTargetsForPolicy. AWS describes it as providing full access to IAM via the AWS Management Console.

What are the security risks of IAMFullAccess?

iam:* on all resources allows every IAM action, not only reads. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. You cannot change the policy, and AWS updates to it affect every identity it is attached to.

IAMFullAccess

High privilegeAdminAWS managedActiveReviewedShow on map Compare

Summary

Provides full access to IAM via the AWS Management Console. The policy allows iam:* plus AWS Organizations Describe and List actions, on all resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/IAMFullAccess
Default version: v2
Created: 2015-02-06
Last edited: 2019-06-21
Services: iam, organizations

Control-plane actions (200)

By access level: 46 List, 23 Permissions management, 41 Read, 16 Tagging, 74 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
IAM	All 190 actions (see the IAM page)	40 List, 23 Permissions management, 37 Read, 16 Tagging, 74 Write; 0 restricted, 0 conditional	iam:*
Organizations	10 of 63	6 List, 4 Read; 0 restricted, 0 conditional	organizations:DescribeAccount, organizations:DescribeOrganization, organizations:DescribeOrganizationalUnit, organizations:DescribePolicy, organizations:ListChildren, organizations:ListParents, organizations:ListPolicies, organizations:ListPoliciesForTarget, organizations:ListRoots, organizations:ListTargetsForPolicy

Organizations: 10 actions

organizations:DescribeAccount (Read)
organizations:DescribeOrganization (Read)
organizations:DescribeOrganizationalUnit (Read)
organizations:DescribePolicy (Read)
organizations:ListChildren (List)
organizations:ListParents (List)
organizations:ListPolicies (List)
organizations:ListPoliciesForTarget (List)
organizations:ListRoots (List)
organizations:ListTargetsForPolicy (List)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: iam (97 of 97).
Grants iam:PassRole on all resources without conditions.
Grants permissions-management actions on iam on all resources without conditions.

Guidance

Practical scope

The policy has one Allow statement with Resource "*". Its Action list is iam:* together with organizations:DescribeAccount, organizations:DescribeOrganization, organizations:DescribeOrganizationalUnit, organizations:DescribePolicy, organizations:ListChildren, organizations:ListParents, organizations:ListPoliciesForTarget, organizations:ListRoots, organizations:ListPolicies and organizations:ListTargetsForPolicy. The IAM actions are not limited to reads.

Use cases

A full access AWS managed policy for service administrators of IAM: the IAM User Guide says full access policies define permissions for service administrators by granting full access to a service, and lists IAMFullAccess as an example.

Best practices

AWS managed policies might not grant least-privilege permissions for your use cases because they are available to all AWS customers. AWS recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

iam:* on Resource "*" allows every IAM action on all resources, not only reads.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits service administrators who need full access to IAM. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case.

Same service

Same domain

Frequently asked questions

When should I attach IAMFullAccess?: The IAM User Guide describes full access policies as defining permissions for service administrators by granting full access to a service, and lists IAMFullAccess as an example. Where you need less than full IAM access, AWS recommends defining a customer managed policy specific to your use case.
What does IAMFullAccess grant?: It allows iam:* on all resources, plus these AWS Organizations actions: DescribeAccount, DescribeOrganization, DescribeOrganizationalUnit, DescribePolicy, ListChildren, ListParents, ListPoliciesForTarget, ListRoots, ListPolicies and ListTargetsForPolicy. AWS describes it as providing full access to IAM via the AWS Management Console.
What are the security risks of IAMFullAccess?: iam:* on all resources allows every IAM action, not only reads. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. You cannot change the policy, and AWS updates to it affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:*",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:DescribePolicy",
        "organizations:ListChildren",
        "organizations:ListParents",
        "organizations:ListPoliciesForTarget",
        "organizations:ListRoots",
        "organizations:ListPolicies",
        "organizations:ListTargetsForPolicy"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v2, edited by AWS on 2019-06-21. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/IAMFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/IAMFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/IAMFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/IAMFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "iamfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/IAMFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("IAMFullAccess"),
);

Sources

IAMFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports useCases, assignmentGuidance, faqs)
AWS managed policies for AWS Identity and Access Management (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, securityConsiderations, assignmentGuidance, faqs)