5 Common AWS IAM Mistakes (and How to Fix Them)

1. Using AdministratorAccess for Everything

The mistake:

It's tempting to just attach the AdministratorAccess policy to users, roles, or services when you're in a rush. But this gives full permissions to literally everything in your AWS account. A small mistake (like deleting an S3 bucket or misconfiguring a VPC) can snowball into huge issues.

The fix:

• Apply least privilege: give only the exact permissions needed.
• Use AWS managed policies for common services as a starting point, then fine-tune.
• For experiments, create separate sandbox accounts instead of granting admin everywhere.

2. Hardcoding IAM Credentials in Code

The mistake:

Developers sometimes copy-paste IAM access keys into config files or, worse, directly inside code. This not only risks leaks on GitHub but also violates security best practices.

The fix:

• Use IAM roles with services like EC2, Lambda, and ECS.
• If you must use keys, store them in AWS Secrets Manager or SSM Parameter Store.
• Regularly rotate credentials and audit with IAM Access Analyzer.

3. Ignoring Service Control Policies (SCPs)

The mistake:

Organizations with multiple accounts often forget to set up SCPs. Without them, accounts may create resources or use services outside your governance model.

The fix:

• Use AWS Organizations to define guardrails with SCPs.
• Example: allows users to share resources with only organization o-12345abcdef
• Combine SCPs with IAM policies for layered security.

4. Not Using Conditions in IAM Policies

The mistake:

Policies often get written with only Action and Resource, but conditions are ignored. This makes them broader than they should be.

The fix:

Use conditions to tighten access:

• Restrict IAM actions to certain IP ranges (aws:SourceIp).
• Allow S3 access only if the request is encrypted (s3:x-amz-server-side-encryption).
• Enforce MFA (aws:MultiFactorAuthPresent).

This extra step can make a huge difference in reducing risk.

5. Not Monitoring IAM Usage

The mistake:

IAM permissions are often set and forgotten. Over time, unused roles, stale users, and outdated policies pile up, becoming a security risk.

The fix:

• Enable IAM Access Advisor and Credential Reports to spot unused permissions.
• Rotate or delete old users/keys.
• Set up CloudTrail to log and monitor IAM activity.