{"schemaVersion":1,"generatedAt":"2026-09-28T07:09:06.862Z","documentation":"https://iamtrail.com/findings/#methodology","levels":["critical","high","medium"],"count":582,"policies":[{"name":"AdministratorAccess","level":"critical","signals":[{"id":"admin","severity":"critical","title":"Full administrator access"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"apprunner-001","unrestricted":true},{"id":"apprunner-002","unrestricted":true},{"id":"batch-001","unrestricted":true},{"id":"batch-002","unrestricted":true},{"id":"batch-003","unrestricted":true},{"id":"bedrock-001","unrestricted":true},{"id":"bedrock-002","unrestricted":true},{"id":"bedrock-003","unrestricted":true},{"id":"bedrock-004","unrestricted":true},{"id":"bedrock-005","unrestricted":true},{"id":"bedrock-006","unrestricted":true},{"id":"bedrock-007","unrestricted":true},{"id":"braket-001","unrestricted":true},{"id":"cloudformation-001","unrestricted":true},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-003","unrestricted":true},{"id":"cloudformation-004","unrestricted":true},{"id":"cloudformation-005","unrestricted":true},{"id":"codebuild-001","unrestricted":true},{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"codebuild-004","unrestricted":true},{"id":"codedeploy-001","unrestricted":true},{"id":"cognitoidentity-001","unrestricted":true},{"id":"datapipeline-001","unrestricted":true},{"id":"ec2-001","unrestricted":true},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":true},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ec2instanceconnect-003","unrestricted":true},{"id":"ecs-001","unrestricted":true},{"id":"ecs-002","unrestricted":true},{"id":"ecs-003","unrestricted":true},{"id":"ecs-004","unrestricted":true},{"id":"ecs-005","unrestricted":true},{"id":"ecs-006","unrestricted":true},{"id":"ecs-007","unrestricted":true},{"id":"ecs-008","unrestricted":true},{"id":"ecs-009","unrestricted":true},{"id":"emr-001","unrestricted":true},{"id":"emrserverless-001","unrestricted":true},{"id":"gamelift-001","unrestricted":true},{"id":"glue-001","unrestricted":true},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":true},{"id":"glue-004","unrestricted":true},{"id":"glue-005","unrestricted":true},{"id":"glue-006","unrestricted":true},{"id":"glue-007","unrestricted":true},{"id":"iam-001","unrestricted":true},{"id":"iam-002","unrestricted":true},{"id":"iam-003","unrestricted":true},{"id":"iam-004","unrestricted":true},{"id":"iam-005","unrestricted":true},{"id":"iam-006","unrestricted":true},{"id":"iam-007","unrestricted":true},{"id":"iam-008","unrestricted":true},{"id":"iam-009","unrestricted":true},{"id":"iam-010","unrestricted":true},{"id":"iam-011","unrestricted":true},{"id":"iam-012","unrestricted":true},{"id":"iam-013","unrestricted":true},{"id":"iam-014","unrestricted":true},{"id":"iam-015","unrestricted":true},{"id":"iam-016","unrestricted":true},{"id":"iam-017","unrestricted":true},{"id":"iam-018","unrestricted":true},{"id":"iam-019","unrestricted":true},{"id":"iam-020","unrestricted":true},{"id":"iam-021","unrestricted":true},{"id":"imagebuilder-001","unrestricted":true},{"id":"kinesisanalytics-001","unrestricted":true},{"id":"lambda-001","unrestricted":true},{"id":"lambda-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"lambda-006","unrestricted":true},{"id":"omics-001","unrestricted":true},{"id":"sagemaker-001","unrestricted":true},{"id":"sagemaker-002","unrestricted":true},{"id":"sagemaker-003","unrestricted":true},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"scheduler-001","unrestricted":true},{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":true},{"id":"ssm-003","unrestricted":true},{"id":"stepfunctions-001","unrestricted":true},{"id":"stepfunctions-002","unrestricted":true},{"id":"sts-001","unrestricted":true}]},{"name":"AdministratorAccess-Amplify","level":"critical","signals":[{"id":"self-escalation","severity":"critical","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"critical","title":"Can take over other users or roles"},{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 5 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"cognitoidentity-001","unrestricted":true},{"id":"iam-001","unrestricted":true},{"id":"iam-005","unrestricted":true},{"id":"iam-009","unrestricted":true},{"id":"iam-012","unrestricted":true},{"id":"iam-014","unrestricted":true},{"id":"iam-016","unrestricted":true},{"id":"iam-017","unrestricted":true},{"id":"iam-019","unrestricted":true},{"id":"iam-020","unrestricted":true},{"id":"iam-021","unrestricted":true},{"id":"lambda-001","unrestricted":true},{"id":"lambda-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"lambda-006","unrestricted":true},{"id":"sts-001","unrestricted":true}]},{"name":"IAMFullAccess","level":"critical","signals":[{"id":"self-escalation","severity":"critical","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"critical","title":"Can take over other users or roles"},{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full iam access on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"iam-001","unrestricted":true},{"id":"iam-002","unrestricted":true},{"id":"iam-003","unrestricted":true},{"id":"iam-004","unrestricted":true},{"id":"iam-005","unrestricted":true},{"id":"iam-006","unrestricted":true},{"id":"iam-007","unrestricted":true},{"id":"iam-008","unrestricted":true},{"id":"iam-009","unrestricted":true},{"id":"iam-010","unrestricted":true},{"id":"iam-011","unrestricted":true},{"id":"iam-012","unrestricted":true},{"id":"iam-013","unrestricted":true},{"id":"iam-015","unrestricted":true},{"id":"iam-018","unrestricted":true},{"id":"iam-019","unrestricted":true},{"id":"iam-020","unrestricted":true},{"id":"iam-021","unrestricted":true}]},{"name":"AWSOpsWorksRegisterCLI","level":"critical","signals":[{"id":"self-escalation","severity":"critical","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"critical","title":"Can take over other users or roles"},{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[{"id":"iam-002","unrestricted":true},{"id":"iam-007","unrestricted":true},{"id":"iam-013","unrestricted":true},{"id":"iam-018","unrestricted":true}]},{"name":"PowerUserAccess","level":"critical","signals":[{"id":"admin","severity":"critical","title":"Near-administrator access"},{"id":"principal-access","severity":"high","title":"Can take over other users or roles"},{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[{"id":"apprunner-002","unrestricted":true},{"id":"batch-002","unrestricted":true},{"id":"bedrock-002","unrestricted":true},{"id":"bedrock-004","unrestricted":true},{"id":"bedrock-007","unrestricted":true},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-005","unrestricted":true},{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"codedeploy-001","unrestricted":true},{"id":"ec2-002","unrestricted":true},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ec2instanceconnect-003","unrestricted":true},{"id":"ecs-006","unrestricted":true},{"id":"glue-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":true},{"id":"stepfunctions-002","unrestricted":true},{"id":"sts-001","unrestricted":true}]},{"name":"AIDevOpsAgentActionsPolicy","level":"critical","signals":[{"id":"admin","severity":"critical","title":"Near-administrator access"},{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[{"id":"apprunner-002","unrestricted":true},{"id":"batch-002","unrestricted":true},{"id":"bedrock-002","unrestricted":true},{"id":"bedrock-004","unrestricted":true},{"id":"bedrock-007","unrestricted":true},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-005","unrestricted":true},{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"codedeploy-001","unrestricted":true},{"id":"ec2-002","unrestricted":true},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ec2instanceconnect-003","unrestricted":true},{"id":"ecs-006","unrestricted":true},{"id":"glue-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":true},{"id":"stepfunctions-002","unrestricted":true}]},{"name":"AWSMcpServiceActionsFullAccess","level":"high","signals":[{"id":"admin","severity":"high","title":"Full access to every action, under a condition"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"apprunner-001","unrestricted":false},{"id":"apprunner-002","unrestricted":false},{"id":"batch-001","unrestricted":false},{"id":"batch-002","unrestricted":false},{"id":"batch-003","unrestricted":false},{"id":"bedrock-001","unrestricted":false},{"id":"bedrock-002","unrestricted":false},{"id":"bedrock-003","unrestricted":false},{"id":"bedrock-004","unrestricted":false},{"id":"bedrock-005","unrestricted":false},{"id":"bedrock-006","unrestricted":false},{"id":"bedrock-007","unrestricted":false},{"id":"braket-001","unrestricted":false},{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"codebuild-001","unrestricted":false},{"id":"codebuild-002","unrestricted":false},{"id":"codebuild-003","unrestricted":false},{"id":"codebuild-004","unrestricted":false},{"id":"codedeploy-001","unrestricted":false},{"id":"cognitoidentity-001","unrestricted":false},{"id":"datapipeline-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-003","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false},{"id":"ec2instanceconnect-003","unrestricted":false},{"id":"ecs-001","unrestricted":false},{"id":"ecs-002","unrestricted":false},{"id":"ecs-003","unrestricted":false},{"id":"ecs-004","unrestricted":false},{"id":"ecs-005","unrestricted":false},{"id":"ecs-006","unrestricted":false},{"id":"ecs-007","unrestricted":false},{"id":"ecs-008","unrestricted":false},{"id":"ecs-009","unrestricted":false},{"id":"emr-001","unrestricted":false},{"id":"emrserverless-001","unrestricted":false},{"id":"gamelift-001","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":false},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"iam-001","unrestricted":false},{"id":"iam-002","unrestricted":false},{"id":"iam-003","unrestricted":false},{"id":"iam-004","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-006","unrestricted":false},{"id":"iam-007","unrestricted":false},{"id":"iam-008","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-010","unrestricted":false},{"id":"iam-011","unrestricted":false},{"id":"iam-012","unrestricted":false},{"id":"iam-013","unrestricted":false},{"id":"iam-014","unrestricted":false},{"id":"iam-015","unrestricted":false},{"id":"iam-016","unrestricted":false},{"id":"iam-017","unrestricted":false},{"id":"iam-018","unrestricted":false},{"id":"iam-019","unrestricted":false},{"id":"iam-020","unrestricted":false},{"id":"iam-021","unrestricted":false},{"id":"imagebuilder-001","unrestricted":false},{"id":"kinesisanalytics-001","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false},{"id":"lambda-005","unrestricted":false},{"id":"lambda-006","unrestricted":false},{"id":"omics-001","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":false},{"id":"sagemaker-005","unrestricted":false},{"id":"scheduler-001","unrestricted":false},{"id":"ssm-001","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"ssm-003","unrestricted":false},{"id":"stepfunctions-001","unrestricted":false},{"id":"stepfunctions-002","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSElasticBeanstalkFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 14 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":true},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-003","unrestricted":true},{"id":"cloudformation-004","unrestricted":true},{"id":"cloudformation-005","unrestricted":true},{"id":"codebuild-001","unrestricted":true},{"id":"codebuild-002","unrestricted":true},{"id":"ec2-001","unrestricted":true},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":true},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ecs-001","unrestricted":true},{"id":"ecs-002","unrestricted":true},{"id":"ecs-003","unrestricted":true},{"id":"ecs-004","unrestricted":true},{"id":"ecs-005","unrestricted":true},{"id":"ecs-006","unrestricted":true},{"id":"ecs-007","unrestricted":true},{"id":"ecs-008","unrestricted":true},{"id":"ecs-009","unrestricted":true},{"id":"iam-009","unrestricted":false}]},{"name":"SageMakerStudioAdminIAMPermissiveExecutionPolicy","level":"high","signals":[{"id":"principal-access","severity":"high","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 34 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":true},{"id":"emr-001","unrestricted":false},{"id":"emrserverless-001","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-014","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"scheduler-001","unrestricted":false},{"id":"sts-001","unrestricted":true}]},{"name":"SageMakerStudioAdminIAMDefaultExecutionPolicy","level":"high","signals":[{"id":"principal-access","severity":"high","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 16 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":true},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-014","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"scheduler-001","unrestricted":false},{"id":"sts-001","unrestricted":true}]},{"name":"AmazonDynamoDBFullAccesswithDataPipeline","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"datapipeline-001","unrestricted":true},{"id":"ec2-001","unrestricted":true},{"id":"emr-001","unrestricted":true},{"id":"lambda-001","unrestricted":true},{"id":"lambda-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"lambda-006","unrestricted":true}]},{"name":"AmazonEC2ContainerServiceFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":true},{"id":"cloudformation-002","unrestricted":true},{"id":"ecs-001","unrestricted":true},{"id":"ecs-002","unrestricted":true},{"id":"ecs-003","unrestricted":true},{"id":"ecs-004","unrestricted":true},{"id":"ecs-005","unrestricted":true},{"id":"ecs-006","unrestricted":true},{"id":"ecs-007","unrestricted":true},{"id":"ecs-008","unrestricted":true},{"id":"ecs-009","unrestricted":true}]},{"name":"SageMakerStudioUserIAMPermissiveExecutionPolicy","level":"high","signals":[{"id":"principal-access","severity":"high","title":"Can take over other users or roles"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 30 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"emr-001","unrestricted":false},{"id":"emrserverless-001","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"scheduler-001","unrestricted":false},{"id":"sts-001","unrestricted":true}]},{"name":"SystemAdministrator","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 16 services on every resource"}],"escalationPaths":[{"id":"codedeploy-001","unrestricted":true},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":false},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"lambda-001","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true}]},{"name":"AWSLambdaFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 6 services on every resource"}],"escalationPaths":[{"id":"lambda-001","unrestricted":true},{"id":"lambda-002","unrestricted":true},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"lambda-006","unrestricted":true}]},{"name":"SageMakerStudioUserIAMDefaultExecutionPolicy","level":"high","signals":[{"id":"principal-access","severity":"high","title":"Can take over other users or roles"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 5 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"scheduler-001","unrestricted":false},{"id":"sts-001","unrestricted":true}]},{"name":"AWSElasticBeanstalkService","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full elasticbeanstalk access on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"codebuild-001","unrestricted":true},{"id":"codebuild-002","unrestricted":true},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSDataPipelineRole","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"ec2-001","unrestricted":true},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":true},{"id":"emr-001","unrestricted":true}]},{"name":"AWSCodeStarServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 11 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"codebuild-001","unrestricted":false},{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"codebuild-004","unrestricted":false},{"id":"codedeploy-001","unrestricted":true},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":false},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"iam-001","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-008","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 5 services on every resource"}],"escalationPaths":[{"id":"codebuild-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"stepfunctions-002","unrestricted":false}]},{"name":"AmazonElasticMapReduceFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":true},{"id":"ec2-001","unrestricted":true},{"id":"ec2-003","unrestricted":true},{"id":"emr-001","unrestricted":true}]},{"name":"DataScientist","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 13 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-003","unrestricted":false},{"id":"emr-001","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true}]},{"name":"AWSDeepRacerCloudFormationAccessPolicy","level":"high","signals":[{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full cloudformation access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":true},{"id":"lambda-003","unrestricted":false}]},{"name":"AmazonECS_FullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full ecs access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":true},{"id":"codedeploy-001","unrestricted":true},{"id":"ec2-001","unrestricted":false},{"id":"ecs-001","unrestricted":false},{"id":"ecs-002","unrestricted":false},{"id":"ecs-003","unrestricted":false},{"id":"ecs-004","unrestricted":false},{"id":"ecs-005","unrestricted":false},{"id":"ecs-006","unrestricted":true},{"id":"ecs-007","unrestricted":false},{"id":"ecs-008","unrestricted":false},{"id":"ecs-009","unrestricted":false}]},{"name":"AmazonSSMAutomationRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ssm access on every resource"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":true},{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":true}]},{"name":"AmazonSSMFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":true}]},{"name":"AWSGlueConsoleSageMakerNotebookFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glue access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-004","unrestricted":false},{"id":"sagemaker-005","unrestricted":false}]},{"name":"AmazonElasticMapReduceRole","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"ec2-001","unrestricted":true},{"id":"ec2-003","unrestricted":true}]},{"name":"AWSCloudFormationFullAccess","level":"high","signals":[{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full cloudformation access on every resource"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":true},{"id":"cloudformation-005","unrestricted":true}]},{"name":"AmazonSageMakerFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[{"id":"codebuild-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true},{"id":"stepfunctions-002","unrestricted":false}]},{"name":"AutoScalingServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":true},{"id":"ec2-003","unrestricted":false}]},{"name":"AWSGlueConsoleFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glue access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"glue-001","unrestricted":false},{"id":"glue-002","unrestricted":true},{"id":"glue-003","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-006","unrestricted":false},{"id":"glue-007","unrestricted":false}]},{"name":"SecretsManagerReadWrite","level":"high","signals":[{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full secretsmanager access on every resource"}],"escalationPaths":[{"id":"cloudformation-005","unrestricted":true}]},{"name":"AWSDeepRacerServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true}]},{"name":"AWSLambda_FullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full lambda access on every resource"}],"escalationPaths":[{"id":"lambda-001","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-003","unrestricted":true},{"id":"lambda-004","unrestricted":true},{"id":"lambda-005","unrestricted":true},{"id":"lambda-006","unrestricted":false}]},{"name":"AmazonEC2SpotFleetRole","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"new-passrole","severity":"high","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-003","unrestricted":true}]},{"name":"AmazonSSMMaintenanceWindowRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AmazonSSMServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"BedrockAgentCoreFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full bedrock-agentcore access on every resource"}],"escalationPaths":[{"id":"bedrock-001","unrestricted":false},{"id":"bedrock-002","unrestricted":true},{"id":"bedrock-003","unrestricted":false},{"id":"bedrock-004","unrestricted":true},{"id":"bedrock-005","unrestricted":false},{"id":"bedrock-006","unrestricted":false},{"id":"bedrock-007","unrestricted":true}]},{"name":"AmazonLaunchWizardFullaccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"ssm-003","unrestricted":false}]},{"name":"AmazonDataZoneProjectDeploymentPermissionsBoundary","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"SageMakerStudioProjectUserRolePermissionsBoundary","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AmazonApplicationWizardFullaccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full applicationwizard access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"ssm-003","unrestricted":false}]},{"name":"AmazonEC2FullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[{"id":"ec2-002","unrestricted":true},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true}]},{"name":"AmazonLaunchWizard_Fullaccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"ssm-003","unrestricted":false}]},{"name":"AmazonLaunchWizardFullAccessV2","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"ssm-003","unrestricted":false}]},{"name":"AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"codebuild-002","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true}]},{"name":"AWSServiceRoleForImageBuilder","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ssm-002","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"EC2ImageBuilderExecutionPolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-004","unrestricted":true},{"id":"ec2-005","unrestricted":true},{"id":"ssm-002","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true}]},{"name":"AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false},{"id":"sagemaker-004","unrestricted":true},{"id":"sagemaker-005","unrestricted":true}]},{"name":"AWSCodeBuildAdminAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full codebuild access on every resource"}],"escalationPaths":[{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"ssm-001","unrestricted":false}]},{"name":"AWSBatchFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full batch access on every resource"}],"escalationPaths":[{"id":"batch-001","unrestricted":false},{"id":"batch-002","unrestricted":true},{"id":"batch-003","unrestricted":false}]},{"name":"AWSOpsWorksCMServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"AWSRefactoringToolkitFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"codebuild-002","unrestricted":true},{"id":"ecs-006","unrestricted":false}]},{"name":"AmazonRDSCustomServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"AWSAppRunnerFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full apprunner access on every resource"}],"escalationPaths":[{"id":"apprunner-001","unrestricted":false},{"id":"apprunner-002","unrestricted":true}]},{"name":"AWSCodeBuildDeveloperAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"codebuild-002","unrestricted":true},{"id":"codebuild-003","unrestricted":true},{"id":"ssm-001","unrestricted":false}]},{"name":"AWSGlueServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glue access on every resource"}],"escalationPaths":[{"id":"glue-002","unrestricted":true}]},{"name":"AwsGlueSessionUserRestrictedNotebookServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glue access on every resource"}],"escalationPaths":[{"id":"glue-002","unrestricted":true}]},{"name":"AwsGlueSessionUserRestrictedServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glue access on every resource"}],"escalationPaths":[{"id":"glue-002","unrestricted":true}]},{"name":"AWSStepFunctionsConsoleFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full states access on every resource"}],"escalationPaths":[{"id":"stepfunctions-001","unrestricted":false},{"id":"stepfunctions-002","unrestricted":true}]},{"name":"ServerMigrationServiceRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"AmazonRDSCustomPreviewServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"AWSBackupFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSMigrationHubOrchestratorServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"CloudwatchApplicationInsightsServiceLinkedRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false},{"id":"ssm-002","unrestricted":true}]},{"name":"AmazonGuardDutyServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSCloud9Administrator","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full cloud9 access on every resource"}],"escalationPaths":[{"id":"ssm-001","unrestricted":true}]},{"name":"AWSCloudTrailFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full cloudtrail access on every resource"}],"escalationPaths":[]},{"name":"AWSCodeDeployFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full codedeploy access on every resource"}],"escalationPaths":[{"id":"codedeploy-001","unrestricted":true}]},{"name":"AWSGlueServiceNotebookRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[{"id":"glue-002","unrestricted":true}]},{"name":"AWSIoTDeviceTesterForFreeRTOSFullAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSStepFunctionsFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full states access on every resource"}],"escalationPaths":[{"id":"stepfunctions-002","unrestricted":true}]},{"name":"AWSSystemsManagerJustInTimeAccessTokenPolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":true},{"id":"ssm-002","unrestricted":false}]},{"name":"AmazonInspector2ServiceRolePolicy","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSBackupAdminPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSBackupOperatorAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSBackupServiceRolePolicyForBackup","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSBatchServiceEventTargetRole","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"batch-002","unrestricted":true}]},{"name":"AWSCloud9EnvironmentMember","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":true}]},{"name":"AWSCloud9User","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":true}]},{"name":"AWSCodeDeployDeployerAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"codedeploy-001","unrestricted":true}]},{"name":"AWSConnector","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-002","unrestricted":true}]},{"name":"AWSDataLifecycleManagerSSMFullAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSDirectoryServiceServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSEC2VssRestorePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSFaultInjectionSimulatorEC2Access","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSFaultInjectionSimulatorECSAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSFaultInjectionSimulatorSSMAccess","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSLicenseManagerServiceRolePolicy","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":true}]},{"name":"AWSOpsWorksFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full opsworks access on every resource"}],"escalationPaths":[]},{"name":"AWSOpsWorksRole","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSQuickSetupDistributorPermissionsBoundary","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupPatchPolicyPermissionsBoundary","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupSSMHostMgmtPermissionsBoundary","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"EC2InstanceConnect","level":"high","signals":[{"id":"existing-passrole","severity":"high","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2instanceconnect-003","unrestricted":true}]},{"name":"AgentRegistryFullAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"service-wildcard","severity":"medium","title":"Full agent-registry access on every resource"}],"escalationPaths":[]},{"name":"AmazonCognitoUnAuthedIdentitiesSessionPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"service-wildcard","severity":"medium","title":"Full access to 8 services on every resource"}],"escalationPaths":[]},{"name":"AmazonDetectiveFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full detective access on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2RoleforSSM","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonGuardDutyFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full guardduty access on every resource"}],"escalationPaths":[]},{"name":"AmazonGuardDutyFullAccess_v2","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full guardduty access on every resource"}],"escalationPaths":[]},{"name":"AmazonInspector2FullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full inspector2 access on every resource"}],"escalationPaths":[]},{"name":"AmazonInspector2FullAccess_v2","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full inspector2 access on every resource"}],"escalationPaths":[]},{"name":"AmazonMacieFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full macie2 access on every resource"}],"escalationPaths":[]},{"name":"AmazonSecurityLakePermissionsBoundary","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSBackupOperatorPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSCloudTrail_FullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full cloudtrail access on every resource"}],"escalationPaths":[]},{"name":"AWSOrganizationsFullAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full organizations access on every resource"}],"escalationPaths":[]},{"name":"AWSSecurityHubFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full securityhub access on every resource"}],"escalationPaths":[]},{"name":"AWSSSODirectoryAdministrator","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[]},{"name":"AWSSSOMasterAccountAdministrator","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[]},{"name":"AWSSSOMemberAccountAdministrator","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[]},{"name":"AWSSupplyChainFederationAdminAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"},{"id":"service-wildcard","severity":"medium","title":"Full scn access on every resource"}],"escalationPaths":[]},{"name":"CloudTrailServiceRolePolicy","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full cloudtrail access on every resource"}],"escalationPaths":[]},{"name":"IAMAccessAnalyzerFullAccess","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"},{"id":"service-wildcard","severity":"medium","title":"Full access-analyzer access on every resource"}],"escalationPaths":[]},{"name":"ReadOnlyAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AIDevOpsAgentAccessPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AIOpsAssistantPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AmazonElasticFileSystemsUtils","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AmazonInspector2AmiScanServiceRolePolicy","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"}],"escalationPaths":[]},{"name":"AmazonSSMManagedInstanceCore","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AmazonSSMReadOnlyAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSApplicationMigrationReadOnlyAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSControlTowerIdentityCenterManagementPolicy","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSGrafanaWorkspacePermissionManagement","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSManagedBudgetsSpendLimitManagementAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSManagedControlPolicyManagementAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSManagedServiceAccessManagementAccess","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSResilienceHubV2AssessmentExecutionPolicy","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSSecretsManagerClientReadOnlyAccess","level":"high","signals":[{"id":"secrets","severity":"high","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSSecurityHubServiceRolePolicy","level":"high","signals":[{"id":"monitoring","severity":"high","title":"Can switch off security monitoring"}],"escalationPaths":[]},{"name":"AWSServiceRoleForMonitronPolicy","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"AWSServiceRoleForThorInternalDevPolicy","level":"high","signals":[{"id":"identity-admin","severity":"high","title":"Can change identities and their permissions"}],"escalationPaths":[]},{"name":"SageMakerStudioProjectProvisioningRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"emr-001","unrestricted":false},{"id":"iam-001","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-012","unrestricted":false},{"id":"iam-019","unrestricted":false},{"id":"iam-020","unrestricted":false},{"id":"iam-021","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false},{"id":"lambda-005","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AWSQuickSetupPatchPolicyDeploymentRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false}]},{"name":"AdministratorAccess-AWSElasticBeanstalk","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full elasticbeanstalk access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"codebuild-001","unrestricted":false},{"id":"codebuild-002","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupSSMDeploymentRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false}]},{"name":"AWSTransformNetworkMigrationAgentPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-014","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full elasticbeanstalk access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSTransformApplicationECSDeploymentPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ecs-001","unrestricted":false},{"id":"ecs-002","unrestricted":false},{"id":"ecs-003","unrestricted":false},{"id":"ecs-004","unrestricted":false},{"id":"ecs-008","unrestricted":false}]},{"name":"AWSTransformServerMigrationAgentPolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false},{"id":"ssm-002","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSApplicationMigrationNetworkMigrationMultiAccount","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AWSControlTowerServiceRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryConsoleFullAccess_v2","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full drs access on every resource"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"AWSQuickSetupDeploymentRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AWSServiceCatalogAdminFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-003","unrestricted":false},{"id":"cloudformation-004","unrestricted":false},{"id":"cloudformation-005","unrestricted":false}]},{"name":"AWSServiceRoleForSMS","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"AWSThinkboxDeadlineResourceTrackerAdminPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-005","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AmazonBraketFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full braket access on every resource"}],"escalationPaths":[{"id":"braket-001","unrestricted":false},{"id":"sagemaker-001","unrestricted":false},{"id":"sagemaker-004","unrestricted":false},{"id":"sagemaker-005","unrestricted":false}]},{"name":"AmazonDataZoneProjectRolePermissionsBoundary","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false}]},{"name":"AmazonDynamoDBFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"datapipeline-001","unrestricted":false},{"id":"lambda-002","unrestricted":false}]},{"name":"AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"glue-004","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AmazonSecurityLakeAdministrator","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full securitylake access on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"lambda-002","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AWSBatchServiceRole","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ecs-002","unrestricted":false},{"id":"ecs-004","unrestricted":false},{"id":"ecs-005","unrestricted":false},{"id":"ecs-008","unrestricted":false},{"id":"ecs-009","unrestricted":false}]},{"name":"AWSDeepLensServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full deeplens access on every resource"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false},{"id":"sagemaker-002","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryConsoleFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full drs access on every resource"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"AWSManagedAccountManagementAccess","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-012","unrestricted":false},{"id":"iam-019","unrestricted":false},{"id":"iam-021","unrestricted":false}]},{"name":"AWSProtonCodeBuildProvisioningServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"codebuild-001","unrestricted":false},{"id":"codebuild-002","unrestricted":false}]},{"name":"AWSQuickSetupJITNADeploymentRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AWSSSOServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false},{"id":"iam-012","unrestricted":false},{"id":"iam-019","unrestricted":false},{"id":"iam-021","unrestricted":false}]},{"name":"AWSTransformApplicationDeploymentPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"BatchServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ecs-002","unrestricted":false},{"id":"ecs-004","unrestricted":false},{"id":"ecs-005","unrestricted":false},{"id":"ecs-008","unrestricted":false},{"id":"ecs-009","unrestricted":false}]},{"name":"DatabaseAdministrator","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[{"id":"datapipeline-001","unrestricted":false},{"id":"lambda-002","unrestricted":false}]},{"name":"EC2FastLaunchFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ec2-001","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"SageMakerStudioProjectUserRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false},{"id":"glue-007","unrestricted":false},{"id":"scheduler-001","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AmazonDataZoneEnvironmentRolePermissionsBoundary","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[{"id":"glue-003","unrestricted":false},{"id":"glue-005","unrestricted":false}]},{"name":"AmazonDataZoneRedshiftGlueProvisioningPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AmazonSageMakerPipelinesIntegrations","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"emr-001","unrestricted":false},{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false}]},{"name":"AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"codebuild-002","unrestricted":false}]},{"name":"AWSApplicationMigrationEC2Access","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"AWSApplicationMigrationServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"AWSElasticBeanstalkManagedUpdatesServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full elasticbeanstalk access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSElasticBeanstalkServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"codebuild-001","unrestricted":false},{"id":"codebuild-002","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"AWSOpsWorksRegisterCLI_OnPremises","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"iam-002","unrestricted":false},{"id":"iam-008","unrestricted":false},{"id":"iam-013","unrestricted":false},{"id":"iam-015","unrestricted":false}]},{"name":"CloudWatchSyntheticsFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full synthetics access on every resource"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false},{"id":"lambda-005","unrestricted":false},{"id":"lambda-006","unrestricted":false}]},{"name":"AmazonECSInfrastructureRolePolicyForManagedInstances","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"lambda-001","unrestricted":false},{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false}]},{"name":"AmplifyBackendDeployFullAccess","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false},{"id":"lambda-004","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSElasticBeanstalkRoleCore","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSManagedSettingsAdminAccess","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"iam-009","unrestricted":false},{"id":"iam-014","unrestricted":false},{"id":"sts-001","unrestricted":false}]},{"name":"AWSMarketplaceFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full aws-marketplace access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSTransformInfrastructureExecutorAccessEC2","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"scheduler-001","unrestricted":false},{"id":"ssm-001","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"BedrockAgentCoreRuntimeInstancesOperatorRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-004","unrestricted":false},{"id":"ec2-005","unrestricted":false}]},{"name":"CloudFormationStackSetsOrgMemberServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false},{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"ServerMigration_ServiceRole","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"AmazonConnectFullAccess","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full connect access on every resource"}],"escalationPaths":[{"id":"iam-005","unrestricted":false}]},{"name":"AmazonEKSLocalOutpostServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ssm-001","unrestricted":false}]},{"name":"AmazonEventBridgeFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[{"id":"scheduler-001","unrestricted":false}]},{"name":"AmazonSageMakerCanvasFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"emrserverless-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false}]},{"name":"AWSImageBuilderFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full imagebuilder access on every resource"}],"escalationPaths":[{"id":"imagebuilder-001","unrestricted":false}]},{"name":"AWSLambdaExecute","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full logs access on every resource"}],"escalationPaths":[]},{"name":"AWSLicenseManagerMasterAccountRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false}]},{"name":"AWSPanoramaServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"sagemaker-002","unrestricted":false}]},{"name":"AWSServiceCatalogEndUserFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false}]},{"name":"AWSThinkboxAWSPortalAdminPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-005","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSTransformLandingZoneAgentPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false},{"id":"cloudformation-005","unrestricted":false}]},{"name":"CloudWatchEventsFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[{"id":"scheduler-001","unrestricted":false}]},{"name":"ConfigConformsServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"cloudformation-002","unrestricted":false}]},{"name":"SageMakerStudioAdminIAMConsolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full datazone access on every resource"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false}]},{"name":"ServerMigrationServiceLaunchRole","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-002","unrestricted":false}]},{"name":"WellArchitectedConsoleFullAccess","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"},{"id":"service-wildcard","severity":"medium","title":"Full wellarchitected access on every resource"}],"escalationPaths":[{"id":"iam-001","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AccountManagementFromVercel","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AmazonCloudWatchRUMFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full rum access on every resource"}],"escalationPaths":[{"id":"cognitoidentity-001","unrestricted":false}]},{"name":"AmazonDataZoneSageMakerProvisioningRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AmazonDynamoDBFullAccess_v2","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2RoleforDataPipelineRole","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 7 services on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2RolePolicyForLaunchWizard","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ec2-002","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"AmazonEC2SpotFleetTaggingRole","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-003","unrestricted":false}]},{"name":"AmazonECSServiceRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"ssm-001","unrestricted":false}]},{"name":"AmazonElasticMapReduceforEC2Role","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 6 services on every resource"}],"escalationPaths":[]},{"name":"AmazonEMRFullAccessPolicy_v2","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"emr-001","unrestricted":false}]},{"name":"AmazonEventBridgeSchedulerFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full scheduler access on every resource"}],"escalationPaths":[{"id":"scheduler-001","unrestricted":false}]},{"name":"AmazonKinesisAnalyticsFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full kinesisanalytics access on every resource"}],"escalationPaths":[{"id":"kinesisanalytics-001","unrestricted":false}]},{"name":"AmazonRedshiftAllCommandsFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"sagemaker-002","unrestricted":false},{"id":"sagemaker-003","unrestricted":false}]},{"name":"AmazonS3FullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonSageMakerCanvasDataPrepFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"emrserverless-001","unrestricted":false},{"id":"sagemaker-003","unrestricted":false}]},{"name":"AmazonSageMakerModelCustomizationCoreAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"lambda-001","unrestricted":false},{"id":"sagemaker-002","unrestricted":false}]},{"name":"AWSApplicationMigrationFullAccess","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full mgn access on every resource"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSAppMeshFullAccess","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"service-wildcard","severity":"medium","title":"Full appmesh access on every resource"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false}]},{"name":"AWSB9InternalServicePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false}]},{"name":"AWSBackupServiceRolePolicyForRestores","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSCloud9ServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-001","unrestricted":false},{"id":"ec2-001","unrestricted":false}]},{"name":"AWSDataPipeline_FullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full datapipeline access on every resource"}],"escalationPaths":[{"id":"datapipeline-001","unrestricted":false}]},{"name":"AWSDataPipeline_PowerUser","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"service-wildcard","severity":"medium","title":"Full datapipeline access on every resource"}],"escalationPaths":[{"id":"datapipeline-001","unrestricted":false}]},{"name":"AWSEC2FleetServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-003","unrestricted":false}]},{"name":"AWSEC2SpotFleetServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false},{"id":"ec2-003","unrestricted":false}]},{"name":"AWSRoboMakerServicePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false}]},{"name":"AWSRoboMakerServiceRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[{"id":"lambda-003","unrestricted":false}]},{"name":"AWSSDMPServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-005","unrestricted":false},{"id":"iam-009","unrestricted":false}]},{"name":"AWSServiceRoleForAmazonEKSNodegroup","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSSystemsManagerJustInTimeAccessTokenSessionPolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":false},{"id":"ssm-002","unrestricted":false}]},{"name":"CloudWatchFullAccess","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[]},{"name":"CloudWatchFullAccessV2","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 6 services on every resource"}],"escalationPaths":[]},{"name":"CloudWatchLogsFullAccess","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full logs access on every resource"}],"escalationPaths":[]},{"name":"NetworkAdministrator","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 5 services on every resource"}],"escalationPaths":[]},{"name":"AmazonAPIGatewayAdministrator","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full apigateway access on every resource"}],"escalationPaths":[]},{"name":"AmazonBraketJobsExecutionPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"braket-001","unrestricted":false}]},{"name":"AmazonChimeFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full chime access on every resource"}],"escalationPaths":[]},{"name":"AmazonCodeGuruProfilerFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonDataZoneFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full datazone access on every resource"}],"escalationPaths":[]},{"name":"AmazonDynamoDBReadOnlyAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonEC2ContainerRegistryFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ecr access on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2ContainerServiceEventsRole","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ecs-008","unrestricted":false}]},{"name":"AmazonEKSComputePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AmazonEKSConnectorServiceRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":false}]},{"name":"AmazonElasticContainerRegistryPublicFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ecr-public access on every resource"}],"escalationPaths":[]},{"name":"AmazonElasticTranscoderRole","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonEMRServicePolicy_v2","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AmazonESCognitoAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cognitoidentity-001","unrestricted":false}]},{"name":"AmazonGlacierFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full glacier access on every resource"}],"escalationPaths":[]},{"name":"AmazonLambdaRolePolicyForLaunchWizardSAP","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AmazonMachineLearningRoleforRedshiftDataSource","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonMonitronFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full monitron access on every resource"}],"escalationPaths":[]},{"name":"AmazonMQApiFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full mq access on every resource"}],"escalationPaths":[]},{"name":"AmazonMQFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full mq access on every resource"}],"escalationPaths":[]},{"name":"AmazonMSKFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full kafka access on every resource"}],"escalationPaths":[]},{"name":"AmazonOpenSearchServiceCognitoAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cognitoidentity-001","unrestricted":false}]},{"name":"AmazonRedshiftFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53RecoveryControlConfigFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full route53-recovery-control-config access on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53ResolverFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full route53resolver access on every resource"}],"escalationPaths":[]},{"name":"AmazonS3ExpressFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full s3express access on every resource"}],"escalationPaths":[]},{"name":"AmazonS3FilesFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full s3files access on every resource"}],"escalationPaths":[]},{"name":"AmazonS3OutpostsFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full s3-outposts access on every resource"}],"escalationPaths":[]},{"name":"AmazonS3TablesFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full s3tables access on every resource"}],"escalationPaths":[]},{"name":"AmazonSageMakerSpacesControllerPolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-001","unrestricted":false}]},{"name":"AmazonSESFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ses access on every resource"}],"escalationPaths":[]},{"name":"AmazonSNSFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full sns access on every resource"}],"escalationPaths":[]},{"name":"AmazonSQSFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full sqs access on every resource"}],"escalationPaths":[]},{"name":"AmazonVPCFullAccess","level":"medium","signals":[{"id":"monitoring","severity":"medium","title":"Can switch off security monitoring"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonWorkLinkFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full worklink access on every resource"}],"escalationPaths":[]},{"name":"AmazonWorkMailFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonZocaloFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWS-SSM-DiagnosisAutomation-OperationalAccountAdministrationRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWS-SSM-RemediationAutomation-AdministrationRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWSApplicationMigrationSSMAccess","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSAppSyncAdministrator","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full appsync access on every resource"}],"escalationPaths":[]},{"name":"AWSBackupServiceRolePolicyForS3Restore","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSBatchServiceRolePolicyForSageMaker","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"sagemaker-002","unrestricted":false}]},{"name":"AWSCertificateManagerPrivateCAFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full acm-pca access on every resource"}],"escalationPaths":[]},{"name":"AWSCleanRoomsMLFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full cleanrooms-ml access on every resource"}],"escalationPaths":[]},{"name":"AWSCloudHSMFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full cloudhsm access on every resource"}],"escalationPaths":[]},{"name":"AWSCloudWatchOmniServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSCodeArtifactAdminAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full codeartifact access on every resource"}],"escalationPaths":[]},{"name":"AWSCodePipeline_FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full codepipeline access on every resource"},{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[]},{"name":"AWSCodePipelineReadOnlyAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSDataSyncFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full datasync access on every resource"}],"escalationPaths":[]},{"name":"AWSDeepRacerRoboMakerAccessPolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full robomaker access on every resource"}],"escalationPaths":[]},{"name":"AWSDirectoryServiceFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ds access on every resource"}],"escalationPaths":[]},{"name":"AWSEC2SpotServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSEC2SqlHaServiceRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSElasticBeanstalkMaintenance","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-005","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryEc2InstancePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryLaunchActionsPolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSElasticDisasterRecoveryRecoveryInstancePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWSElementalMediaTailorFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full mediatailor access on every resource"}],"escalationPaths":[]},{"name":"AWSEntityResolutionConsoleFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full entityresolution access on every resource"}],"escalationPaths":[]},{"name":"AWSFMAdminFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[]},{"name":"AWSForWordPressPluginPolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false}]},{"name":"AwsGlueSessionUserRestrictedNotebookPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"glue-007","unrestricted":false}]},{"name":"AwsGlueSessionUserRestrictedPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"glue-007","unrestricted":false}]},{"name":"AWSGrafanaAccountAdministrator","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full grafana access on every resource"}],"escalationPaths":[]},{"name":"AWSGreengrassResourceAccessRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"service-wildcard","severity":"medium","title":"Full greengrass access on every resource"}],"escalationPaths":[]},{"name":"AWSHealthFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full health access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTDeviceTesterForGreengrassFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full greengrass access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSIQPermissionServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSLakeFormationDataAdmin","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full lakeformation access on every resource"}],"escalationPaths":[]},{"name":"AWSLambdaReadOnlyAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSLicenseManagerUserSubscriptionsServiceRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-005","unrestricted":false}]},{"name":"AWSManagedServicesDeploymentToolkitPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"cloudformation-005","unrestricted":false}]},{"name":"AWSMarketplaceImageBuildFullAccess","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSNetworkManagerFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full networkmanager access on every resource"}],"escalationPaths":[]},{"name":"AWSObservabilityAdminTelemetryEnablementServiceRolePolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSOpsWorks_FullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full opsworks access on every resource"}],"escalationPaths":[]},{"name":"AWSPartnerCentralChannelManagement","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWSPartnerCentralFullAccess","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"AWSPCSServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSPrivateCAFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full acm-pca access on every resource"}],"escalationPaths":[]},{"name":"AWSQuickSetupEnableDHMCExecutionPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupManagedInstanceProfileExecutionPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupManageJITNAResourcesExecutionPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSQuickSetupSSMManageResourcesExecutionPolicy","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"AWSResourceAccessManagerFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ram access on every resource"}],"escalationPaths":[]},{"name":"AWSResourceExplorerFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full resource-explorer-2 access on every resource"}],"escalationPaths":[]},{"name":"AWSResourceExplorerOrganizationsAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full resource-explorer-2 access on every resource"}],"escalationPaths":[]},{"name":"AWSRoboMakerFullAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full robomaker access on every resource"}],"escalationPaths":[]},{"name":"AWSServiceCatalogAppRegistryFullAccess","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"cloudformation-002","unrestricted":false}]},{"name":"AWSServiceRoleForGammaInternalAmazonEKSNodegroup","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSShieldDRTAccessPolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 4 services on every resource"}],"escalationPaths":[]},{"name":"AWSSSMForSAPServiceLinkedRolePolicy","level":"medium","signals":[{"id":"existing-passrole","severity":"medium","title":"Can take over existing resources that run as another role"}],"escalationPaths":[{"id":"ssm-002","unrestricted":false}]},{"name":"AWSSystemsManagerForSAPFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full ssm-sap access on every resource"}],"escalationPaths":[]},{"name":"AWSThinkboxDeadlineSpotEventPluginAdminPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"AWSTransformInfrastructureExecutorAccessBatch","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"scheduler-001","unrestricted":false}]},{"name":"AWSWAFConsoleFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSWAFFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"ClientVPNServiceRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"CloudFormationStackSetsOrgAdminServiceRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"CloudSearchFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full cloudsearch access on every resource"}],"escalationPaths":[]},{"name":"CloudWatch-CrossAccountAccess","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"CloudWatchInternetMonitorFullAccess","level":"medium","signals":[{"id":"self-escalation","severity":"medium","title":"Can grant itself more permissions"}],"escalationPaths":[{"id":"iam-009","unrestricted":false}]},{"name":"EC2FastLaunchServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"EC2FleetTimeShiftableServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"MultiPartyApprovalFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full mpa access on every resource"}],"escalationPaths":[]},{"name":"ROSAInstallerPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"ROSAKarpenterControllerPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"ROSANodePoolManagementPolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"SageMakerStudioEMRContainersSystemNamespaceRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"SageMakerStudioEMRInstanceRolePolicy","level":"medium","signals":[{"id":"principal-access","severity":"medium","title":"Can take over other users or roles"}],"escalationPaths":[{"id":"sts-001","unrestricted":false}]},{"name":"SageMakerStudioEMRServiceRolePolicy","level":"medium","signals":[{"id":"new-passrole","severity":"medium","title":"Can launch resources that run as a more privileged role"}],"escalationPaths":[{"id":"ec2-001","unrestricted":false}]},{"name":"SageMakerStudioFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full datazone access on every resource"}],"escalationPaths":[]},{"name":"ServiceCatalogAdminReadOnlyAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full catalog-user access on every resource"}],"escalationPaths":[]},{"name":"ServiceCatalogEndUserAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"},{"id":"service-wildcard","severity":"medium","title":"Full catalog-user access on every resource"}],"escalationPaths":[]},{"name":"SupportUser","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"},{"id":"service-wildcard","severity":"medium","title":"Full support access on every resource"}],"escalationPaths":[]},{"name":"VPCLatticeFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"},{"id":"service-wildcard","severity":"medium","title":"Full vpc-lattice access on every resource"}],"escalationPaths":[]},{"name":"AIOpsConsoleAdminPolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full aiops access on every resource"}],"escalationPaths":[]},{"name":"AlexaForBusinessFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full a4b access on every resource"}],"escalationPaths":[]},{"name":"AmazonAppFlowFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full appflow access on every resource"}],"escalationPaths":[]},{"name":"AmazonAppStreamFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full appstream access on every resource"}],"escalationPaths":[]},{"name":"AmazonAthenaFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full athena access on every resource"}],"escalationPaths":[]},{"name":"AmazonBedrockFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonBedrockMantleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full bedrock-mantle access on every resource"}],"escalationPaths":[]},{"name":"AmazonBioDiscoveryFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full researchstudio access on every resource"}],"escalationPaths":[]},{"name":"AmazonBioDiscoveryInAppFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full researchstudio access on every resource"}],"escalationPaths":[]},{"name":"AmazonCloudDirectoryFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full clouddirectory access on every resource"}],"escalationPaths":[]},{"name":"AmazonCloudWatchEvidentlyFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full evidently access on every resource"}],"escalationPaths":[]},{"name":"AmazonCodeCatalystFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full codecatalyst access on every resource"}],"escalationPaths":[]},{"name":"AmazonCodeGuruReviewerFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonCodeGuruSecurityFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full codeguru-security access on every resource"}],"escalationPaths":[]},{"name":"AmazonCognitoPowerUser","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 3 services on every resource"}],"escalationPaths":[]},{"name":"AmazonConnect_FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full connect access on every resource"}],"escalationPaths":[]},{"name":"AmazonConnectServiceLinkedRolePolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full connect access on every resource"}],"escalationPaths":[]},{"name":"AmazonConnectVoiceIDFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full voiceid access on every resource"}],"escalationPaths":[]},{"name":"AmazonDataZoneDomainExecutionRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonDataZoneFullUserAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonDataZoneGlueManageAccessRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonDataZonePortalFullAccessPolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full datazonecontrol access on every resource"}],"escalationPaths":[]},{"name":"AmazonDataZonePreviewConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full datazonecontrol access on every resource"}],"escalationPaths":[]},{"name":"AmazonDevOpsGuruConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full devops-guru access on every resource"}],"escalationPaths":[]},{"name":"AmazonDevOpsGuruFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full devops-guru access on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2ReportsAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full ec2-reports access on every resource"}],"escalationPaths":[]},{"name":"AmazonEC2RoleforAWSCodeDeploy","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonEKSForFargateServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonEKSServicePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonEKSServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonElastiCacheFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full elasticache access on every resource"}],"escalationPaths":[]},{"name":"AmazonElasticFileSystemFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonElasticMapReduceEditorsRole","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonElasticMapReduceReadOnlyAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonElasticTranscoder_FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full elastictranscoder access on every resource"}],"escalationPaths":[]},{"name":"AmazonESFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full es access on every resource"}],"escalationPaths":[]},{"name":"AmazonEventBridgePipesFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full pipes access on every resource"}],"escalationPaths":[]},{"name":"AmazonEventBridgeSchemasFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full schemas access on every resource"}],"escalationPaths":[]},{"name":"AmazonForecastFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full forecast access on every resource"}],"escalationPaths":[]},{"name":"AmazonFraudDetectorFullAccessPolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full frauddetector access on every resource"}],"escalationPaths":[]},{"name":"AmazonFreeRTOSFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full freertos access on every resource"}],"escalationPaths":[]},{"name":"AmazonFSxServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonHealthLakeFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full healthlake access on every resource"}],"escalationPaths":[]},{"name":"AmazonHoneycodeFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full honeycode access on every resource"}],"escalationPaths":[]},{"name":"AmazonInspectorFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full inspector access on every resource"}],"escalationPaths":[]},{"name":"AmazonKendraFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full kendra access on every resource"}],"escalationPaths":[]},{"name":"AmazonKeyspacesFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full cassandra access on every resource"}],"escalationPaths":[]},{"name":"AmazonKinesisFirehoseFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full firehose access on every resource"}],"escalationPaths":[]},{"name":"AmazonKinesisFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full kinesis access on every resource"}],"escalationPaths":[]},{"name":"AmazonKinesisVideoStreamsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full kinesisvideo access on every resource"}],"escalationPaths":[]},{"name":"AmazonLexFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full lex access on every resource"}],"escalationPaths":[]},{"name":"AmazonLookoutEquipmentFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full lookoutequipment access on every resource"}],"escalationPaths":[]},{"name":"AmazonLookoutMetricsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full lookoutmetrics access on every resource"}],"escalationPaths":[]},{"name":"AmazonLookoutVisionConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full lookoutvision access on every resource"}],"escalationPaths":[]},{"name":"AmazonLookoutVisionFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full lookoutvision access on every resource"}],"escalationPaths":[]},{"name":"AmazonMachineLearningFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full machinelearning access on every resource"}],"escalationPaths":[]},{"name":"AmazonMachineLearningRoleforRedshiftDataSourceV2","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonMacieServiceRole","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonMacieServiceRolePolicy","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonManagedBlockchainConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full managedblockchain access on every resource"}],"escalationPaths":[]},{"name":"AmazonManagedBlockchainFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full managedblockchain access on every resource"}],"escalationPaths":[]},{"name":"AmazonMCSFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full cassandra access on every resource"}],"escalationPaths":[]},{"name":"AmazonMechanicalTurkCrowdFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full crowd access on every resource"}],"escalationPaths":[]},{"name":"AmazonMechanicalTurkFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mechanicalturk access on every resource"}],"escalationPaths":[]},{"name":"AmazonMemoryDBFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full memorydb access on every resource"}],"escalationPaths":[]},{"name":"AmazonMobileAnalyticsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mobileanalytics access on every resource"}],"escalationPaths":[]},{"name":"AmazonMWAAServerlessServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonMWAAServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonOmicsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full omics access on every resource"}],"escalationPaths":[]},{"name":"AmazonOneEnterpriseFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full one access on every resource"}],"escalationPaths":[]},{"name":"AmazonOpenSearchServiceFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full es access on every resource"}],"escalationPaths":[]},{"name":"AmazonPersonalizeFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full personalize access on every resource"}],"escalationPaths":[]},{"name":"AmazonPollyFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full polly access on every resource"}],"escalationPaths":[]},{"name":"AmazonPrometheusFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full aps access on every resource"}],"escalationPaths":[]},{"name":"AmazonQLDBConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full dbqms access on every resource"}],"escalationPaths":[]},{"name":"AmazonRDSBetaServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonRDSDataFullAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonRDSFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full rds access on every resource"}],"escalationPaths":[]},{"name":"AmazonRDSPreviewServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonRDSServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonRedshiftQueryEditorV2FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full sqlworkbench access on every resource"}],"escalationPaths":[]},{"name":"AmazonRekognitionFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full rekognition access on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53AutoNamingFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full servicediscovery access on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53DomainsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full route53domains access on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53RecoveryClusterFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full route53-recovery-cluster access on every resource"}],"escalationPaths":[]},{"name":"AmazonRoute53RecoveryReadinessFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full route53-recovery-readiness access on every resource"}],"escalationPaths":[]},{"name":"AmazonS3ReadOnlyAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AmazonSageMakerCoreServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonSageMakerGeospatialFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full sagemaker-geospatial access on every resource"}],"escalationPaths":[]},{"name":"AmazonSumerianFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full sumerian access on every resource"}],"escalationPaths":[]},{"name":"AmazonTextractFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full textract access on every resource"}],"escalationPaths":[]},{"name":"AmazonTimestreamConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full timestream access on every resource"}],"escalationPaths":[]},{"name":"AmazonTimestreamFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full timestream access on every resource"}],"escalationPaths":[]},{"name":"AmazonTranscribeFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full transcribe access on every resource"}],"escalationPaths":[]},{"name":"AmazonVerifiedPermissionsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full verifiedpermissions access on every resource"}],"escalationPaths":[]},{"name":"AmazonVPCCrossAccountNetworkInterfaceOperations","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonWorkDocsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full workdocs access on every resource"}],"escalationPaths":[]},{"name":"AmazonWorkLinkServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AmazonWorkMailMessageFlowFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full workmailmessageflow access on every resource"}],"escalationPaths":[]},{"name":"AmazonWorkSpacesThinClientFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full thinclient access on every resource"}],"escalationPaths":[]},{"name":"AnthropicFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full aws-external-anthropic access on every resource"}],"escalationPaths":[]},{"name":"APIGatewayServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AutoScalingConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full autoscaling access on every resource"}],"escalationPaths":[]},{"name":"AutoScalingFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full autoscaling access on every resource"}],"escalationPaths":[]},{"name":"AWS_ConfigRole","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSAccountManagementFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full account access on every resource"}],"escalationPaths":[]},{"name":"AWSAgentlessDiscoveryService","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full discovery access on every resource"}],"escalationPaths":[]},{"name":"AWSAppFabricFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full appfabric access on every resource"}],"escalationPaths":[]},{"name":"AWSApplicationDiscoveryServiceFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSAuditManagerAdministratorAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full auditmanager access on every resource"}],"escalationPaths":[]},{"name":"AWSBackupServiceRolePolicyForS3Backup","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSBillingConductorFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full billingconductor access on every resource"}],"escalationPaths":[]},{"name":"AWSBudgetsActionsWithAWSResourceControlAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full budgets access on every resource"}],"escalationPaths":[]},{"name":"AWSBudgetsSpendLimitMemberRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSBugBustFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full bugbust access on every resource"}],"escalationPaths":[]},{"name":"AWSCertificateManagerFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full acm access on every resource"}],"escalationPaths":[]},{"name":"AWSCleanRoomsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full cleanrooms access on every resource"}],"escalationPaths":[]},{"name":"AWSCloudMapFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full servicediscovery access on every resource"}],"escalationPaths":[]},{"name":"AWSCloudShellFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full cloudshell access on every resource"}],"escalationPaths":[]},{"name":"AWSCloudTrailReadOnlyAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSCodeCommitFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full codecommit access on every resource"}],"escalationPaths":[]},{"name":"AWSCodeDeployRoleForECS","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSCodePipeline_ReadOnlyAccess","level":"medium","signals":[{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[]},{"name":"AWSCodeStarFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full codestar access on every resource"}],"escalationPaths":[]},{"name":"AWSConfigRole","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSConfigServiceRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSDataExchangeFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full dataexchange access on every resource"}],"escalationPaths":[]},{"name":"AWSDeepLensLambdaFunctionAccessPolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full deeplens access on every resource"}],"escalationPaths":[]},{"name":"AWSDeviceFarmFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full devicefarm access on every resource"}],"escalationPaths":[]},{"name":"AWSDirectConnectFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full directconnect access on every resource"}],"escalationPaths":[]},{"name":"AWSElasticBeanstalkReadOnlyAccess","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"AWSElementalMediaConnectFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mediaconnect access on every resource"}],"escalationPaths":[]},{"name":"AWSElementalMediaConvertFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mediaconvert access on every resource"}],"escalationPaths":[]},{"name":"AWSElementalMediaLiveFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full medialive access on every resource"}],"escalationPaths":[]},{"name":"AWSElementalMediaPackageFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mediapackage access on every resource"}],"escalationPaths":[]},{"name":"AWSElementalMediaPackageV2FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mediapackagev2 access on every resource"}],"escalationPaths":[]},{"name":"AwsGlueDataBrewFullAccessPolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSGlueDataBrewServiceRole","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSGreengrassFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full greengrass access on every resource"}],"escalationPaths":[]},{"name":"AWSHealthImagingFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full medical-imaging access on every resource"}],"escalationPaths":[]},{"name":"AWSImportExportFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full importexport access on every resource"}],"escalationPaths":[]},{"name":"AWSIoT1ClickFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iot1click access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTAnalyticsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotanalytics access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTConfigAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSIoTDeviceDefenderReplaceDefaultPolicyMitigationAction","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSIoTEventsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotevents access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTManagedIntegrationsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotmanagedintegrations access on every resource"}],"escalationPaths":[]},{"name":"AWSIotRoboRunnerFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotroborunner access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTSiteWiseConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotsitewise access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTSiteWiseFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotsitewise access on every resource"}],"escalationPaths":[]},{"name":"AWSIoTThingsRegistration","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSIoTWirelessFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full iotwireless access on every resource"}],"escalationPaths":[]},{"name":"AWSIQFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSLakeFormationCrossAccountManager","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSLambda_ReadOnlyAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSLicenseManagerMemberAccountRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSM2ServicePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSManagementConsoleAdministratorAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSMigrationHubFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSMigrationHubOrchestratorConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full migrationhub-orchestrator access on every resource"}],"escalationPaths":[]},{"name":"AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full refactor-spaces access on every resource"}],"escalationPaths":[]},{"name":"AWSMigrationHubRefactorSpacesFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full refactor-spaces access on every resource"}],"escalationPaths":[]},{"name":"AWSMigrationHubStrategyConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full migrationhub-strategy access on every resource"}],"escalationPaths":[]},{"name":"AWSMobileHub_FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full mobilehub access on every resource"}],"escalationPaths":[]},{"name":"AWSNetworkFirewallFullAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSPanoramaFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full panorama access on every resource"}],"escalationPaths":[]},{"name":"AWSPanoramaGreengrassGroupRolePolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full panorama access on every resource"}],"escalationPaths":[]},{"name":"AWSPanoramaServiceLinkedRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSPartnerLedSupportReadOnlyAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSPriceListServiceFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full pricing access on every resource"}],"escalationPaths":[]},{"name":"AWSProtonFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full proton access on every resource"}],"escalationPaths":[]},{"name":"AWSQuickSightAssetBundleImportPolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSResilienceHubAsssessmentExecutionPolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSResourceAccessManagerResourceShareParticipantAccess","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSRoboMaker_FullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full robomaker access on every resource"}],"escalationPaths":[]},{"name":"AWSSavingsPlansFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full savingsplans access on every resource"}],"escalationPaths":[]},{"name":"AWSSecurityIncidentResponseFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full security-ir access on every resource"}],"escalationPaths":[]},{"name":"AWSStorageGatewayFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full storagegateway access on every resource"}],"escalationPaths":[]},{"name":"AWSSupportAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"AWSSupportServiceRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"AWSTransferConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full transfer access on every resource"}],"escalationPaths":[]},{"name":"AWSTransferFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full transfer access on every resource"}],"escalationPaths":[]},{"name":"AWSTransformCustomFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full transform-custom access on every resource"}],"escalationPaths":[]},{"name":"AWSVPCTransitGatewayServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"AWSWickrFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full wickr access on every resource"}],"escalationPaths":[]},{"name":"AWSXrayFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full xray access on every resource"}],"escalationPaths":[]},{"name":"CloudFrontFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"CloudWatchApplicationInsightsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full applicationinsights access on every resource"}],"escalationPaths":[]},{"name":"CloudWatchApplicationSignalsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full application-signals access on every resource"}],"escalationPaths":[]},{"name":"CloudWatchAutomaticDashboardsAccess","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"CloudWatchOmniAWSIntegrationPolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"ComprehendFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full comprehend access on every resource"}],"escalationPaths":[]},{"name":"ComprehendMedicalFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full comprehendmedical access on every resource"}],"escalationPaths":[]},{"name":"ComputeOptimizerServiceRolePolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full compute-optimizer access on every resource"}],"escalationPaths":[]},{"name":"ConsoleFullAccessFromVercel","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"DynamoDBReplicationServiceRolePolicy","level":"medium","signals":[{"id":"data-read","severity":"medium","title":"Can read data in every bucket or table"}],"escalationPaths":[]},{"name":"ElasticLoadBalancingFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full elasticloadbalancing access on every resource"}],"escalationPaths":[]},{"name":"ElementalActivationsFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full elemental-activations access on every resource"}],"escalationPaths":[]},{"name":"ElementalAppliancesSoftwareFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full elemental-appliances-software access on every resource"}],"escalationPaths":[]},{"name":"ElementalSupportCenterFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"FMSServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"GlobalAcceleratorFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full globalaccelerator access on every resource"}],"escalationPaths":[]},{"name":"GroundTruthSyntheticConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full sagemaker-groundtruth-synthetic access on every resource"}],"escalationPaths":[]},{"name":"IVSFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full access to 2 services on every resource"}],"escalationPaths":[]},{"name":"KafkaServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"NeptuneFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full neptune-db access on every resource"}],"escalationPaths":[]},{"name":"OAMFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full oam access on every resource"}],"escalationPaths":[]},{"name":"ResourceGroupsandTagEditorFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full resource-groups access on every resource"}],"escalationPaths":[]},{"name":"Route53RecoveryReadinessServiceRolePolicy","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"S3UnlockBucketPolicy","level":"medium","signals":[{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[]},{"name":"SageMakerStudioDomainExecutionRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]},{"name":"SecurityAudit","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"ServerMigrationConnector","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full awsconnector access on every resource"}],"escalationPaths":[]},{"name":"ServerMigrationServiceConsoleFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full sms access on every resource"}],"escalationPaths":[]},{"name":"ServiceQuotasFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full servicequotas access on every resource"}],"escalationPaths":[]},{"name":"ServiceQuotasServiceRolePolicy","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full support access on every resource"}],"escalationPaths":[]},{"name":"SimpleWorkflowFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full swf access on every resource"}],"escalationPaths":[]},{"name":"SQSUnlockQueuePolicy","level":"medium","signals":[{"id":"access-analyzer","severity":"medium","title":"Flagged by AWS IAM Access Analyzer"}],"escalationPaths":[]},{"name":"TranslateFullAccess","level":"medium","signals":[{"id":"service-wildcard","severity":"medium","title":"Full translate access on every resource"}],"escalationPaths":[]},{"name":"WellArchitectedAgentResourceScanning","level":"medium","signals":[{"id":"secrets","severity":"medium","title":"Can read secrets"}],"escalationPaths":[]},{"name":"WorkLinkServiceRolePolicy","level":"medium","signals":[{"id":"resource-sharing","severity":"medium","title":"Can rewrite resource policies and sharing"}],"escalationPaths":[]}]}