Security findings

AWS managed policies are convenient, and some hand out far more than their name suggests. IAMTrail reads every one of them and flags the policies that grant administrator access, a documented privilege escalation path, secret reads or the power to switch off security monitoring, so you can attach them with your eyes open.

588 policies flagged out of 1,675, re-assessed on every policy change. Last run Nov 2, 2026.

Risk levels

Critical6

Administrator access, or an unrestricted way to grant itself permissions or take over other identities. Treat it as admin.

High130

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring.

Medium452

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service.

244 policies grant every action of at least one documented privilege escalation path, and 82 of them do it on any resource with no condition attached.

Check the policies your account uses

Run this with credentials for your account and paste the output, or paste any list of policy names or ARNs. It is read in your browser and never uploaded.

aws iam list-policies --scope AWS --only-attached --query 'Policies[].Arn' --output text

Risk changes in the last 90 days

Policy versions that AWS made riskier or safer, and new policies that shipped already critical or high. A policy you attached last year can change under you; this is where it shows. Subscribe to the policies you use to hear about the next one.

Policies to use with caution

Highest risk first. Each policy page explains every signal, shows the statement that grants it and how to use the policy safely.

136 policies, highest risk first

  • CriticalAdministratorAccess

    Full administrator access

    Allows every action on every resource. It covers all 92 documented privilege escalation paths by definition.

    Access Analyzer92 escalation paths, all unrestrictedWhy and how to use it
  • CriticalAdministratorAccess-Amplify

    Can grant itself more permissions

    Grants every action of 3 documented escalation paths on any resource with no condition.

    Identity takeoverIdentity adminPassRole, new resourcesPassRole, existing resourcesReads secretsResource policiesReads all dataService wildcardAccess Analyzer22 escalation paths, 18 unrestrictedWhy and how to use it
  • CriticalIAMFullAccess

    Can grant itself more permissions

    Grants every action of 8 documented escalation paths on any resource with no condition.

    Identity takeoverIdentity adminService wildcardAccess Analyzer18 escalation paths, all unrestrictedWhy and how to use it
  • CriticalAWSOpsWorksRegisterCLI

    Can grant itself more permissions

    Grants every action of 2 documented escalation paths on any resource with no condition.

    Identity takeoverIdentity admin4 escalation paths, all unrestrictedWhy and how to use it
  • CriticalPowerUserAccess

    Near-administrator access

    Allows every action except iam, organizations, account on every resource. Whatever it can reach, it can change, read or delete.

    Identity takeoverIdentity adminPassRole, new resourcesPassRole, existing resourcesDisables monitoringReads secretsResource policiesReads all data25 escalation paths, all unrestrictedWhy and how to use it
  • CriticalAIDevOpsAgentActionsPolicy

    Near-administrator access

    Allows every action except account, cognito-identity, iam, identitystore, organizations, ram, rolesanywhere, sso and 1 more on every resource. Whatever it can reach, it can change, read or delete.

    Identity adminPassRole, new resourcesPassRole, existing resourcesDisables monitoringReads secretsResource policiesReads all data24 escalation paths, all unrestrictedWhy and how to use it
  • HighAWSMcpServiceActionsFullAccess

    Full access to every action, under a condition

    Allows every action, limited only by the condition aws:IsMcpServiceAction. Whether that is safe depends entirely on that limit.

    Access Analyzer92 escalation paths, all scopedWhy and how to use it
  • HighAWSElasticBeanstalkFullAccess

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesSelf-escalationDisables monitoringResource policiesReads all dataService wildcard22 escalation paths, 21 unrestrictedWhy and how to use it
  • HighSageMakerStudioAdminIAMPermissiveExecutionPolicy

    Can take over other users or roles

    Grants every action of 1 documented escalation path on any resource with no condition, and 3 more in a scoped form.

    PassRole, new resourcesPassRole, existing resourcesSelf-escalationDisables monitoringReads secretsResource policiesReads all dataService wildcardAccess Analyzer32 escalation paths, 9 unrestrictedWhy and how to use it
  • HighSageMakerStudioAdminIAMDefaultExecutionPolicy

    Can take over other users or roles

    Grants every action of 1 documented escalation path on any resource with no condition, and 3 more in a scoped form.

    PassRole, new resourcesPassRole, existing resourcesSelf-escalationReads secretsResource policiesReads all dataService wildcardAccess Analyzer30 escalation paths, 9 unrestrictedWhy and how to use it
  • HighSageMakerStudioUserIAMPermissiveExecutionPolicy

    Can take over other users or roles

    Grants every action of 1 documented escalation path on any resource with no condition.

    PassRole, existing resourcesPassRole, new resourcesDisables monitoringReads secretsResource policiesReads all dataService wildcardAccess Analyzer28 escalation paths, 7 unrestrictedWhy and how to use it
  • HighAmazonDynamoDBFullAccesswithDataPipeline

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesReads secretsResource policiesReads all dataService wildcardAccess Analyzer9 escalation paths, all unrestrictedWhy and how to use it
  • HighAmazonEC2ContainerServiceFullAccess

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesService wildcard11 escalation paths, all unrestrictedWhy and how to use it
  • HighSystemAdministrator

    Can change identities and their permissions

    Grants 5 permissions management actions on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, existing resourcesDisables monitoringPassRole, new resourcesReads secretsResource policiesReads all dataService wildcard10 escalation paths, 6 unrestrictedWhy and how to use it
  • HighSageMakerStudioUserIAMDefaultExecutionPolicy

    Can take over other users or roles

    Grants every action of 1 documented escalation path on any resource with no condition.

    PassRole, existing resourcesPassRole, new resourcesReads secretsResource policiesReads all dataService wildcardAccess Analyzer18 escalation paths, 4 unrestrictedWhy and how to use it
  • HighAWSLambdaFullAccess

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesDisables monitoringReads secretsResource policiesReads all dataService wildcard6 escalation paths, all unrestrictedWhy and how to use it
  • HighAWSElasticBeanstalkService

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesReads all dataService wildcardAccess Analyzer8 escalation paths, 2 unrestrictedWhy and how to use it
  • HighAWSDataPipelineRole

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesResource policiesReads all dataService wildcard4 escalation paths, all unrestrictedWhy and how to use it
  • HighAWSCodeStarServiceRole

    Can take over existing resources that run as another role

    Grants every action of 6 documented escalation paths on any resource with no condition, and 1 more in a scoped form.

    Self-escalationPassRole, new resourcesDisables monitoringResource policiesService wildcard19 escalation paths, 6 unrestrictedWhy and how to use it
  • HighAmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, existing resourcesPassRole, new resourcesReads secretsResource policiesService wildcard9 escalation paths, 2 unrestrictedWhy and how to use it
  • HighAmazonElasticMapReduceFullAccess

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesResource policiesReads all dataService wildcardAccess Analyzer4 escalation paths, all unrestrictedWhy and how to use it
  • HighDataScientist

    Can take over existing resources that run as another role

    Grants every action of 4 documented escalation paths on any resource with no condition.

    PassRole, new resourcesReads secretsResource policiesReads all dataService wildcard13 escalation paths, 4 unrestrictedWhy and how to use it
  • HighAWSDeepRacerCloudFormationAccessPolicy

    Can launch resources that run as a more privileged role

    Grants every action of 1 documented escalation path on any resource with no condition, and 3 more in a scoped form.

    PassRole, existing resourcesResource policiesService wildcard6 escalation paths, 2 unrestrictedWhy and how to use it
  • HighAmazonECS_FullAccess

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition.

    PassRole, new resourcesService wildcard13 escalation paths, 3 unrestrictedWhy and how to use it
  • HighAmazonSSMAutomationRole

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition.

    Reads secretsResource policiesService wildcard3 escalation paths, all unrestrictedWhy and how to use it
  • HighAmazonSSMFullAccess

    Can take over existing resources that run as another role

    Grants every action of 2 documented escalation paths on any resource with no condition.

    Reads secretsDisables monitoringResource policiesService wildcard2 escalation paths, all unrestrictedWhy and how to use it
  • HighAWSGlueConsoleSageMakerNotebookFullAccess

    Can take over existing resources that run as another role

    Grants every action of 1 documented escalation path on any resource with no condition, and 2 more in a scoped form.

    PassRole, new resourcesReads secretsResource policiesService wildcard12 escalation paths, 1 unrestrictedWhy and how to use it
  • HighAmazonElasticMapReduceRole

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resourcesReads all dataAccess Analyzer2 escalation paths, all unrestrictedWhy and how to use it
  • HighAWSCloudFormationFullAccess

    Can launch resources that run as a more privileged role

    Grants every action of 1 documented escalation path on any resource with no condition.

    PassRole, existing resourcesResource policiesService wildcard2 escalation paths, all unrestrictedWhy and how to use it
  • HighAmazonSageMakerFullAccess

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition, and 1 more in a scoped form.

    PassRole, new resourcesResource policiesService wildcard9 escalation paths, 3 unrestrictedWhy and how to use it
  • HighAutoScalingServiceRolePolicy

    Can take over existing resources that run as another role

    Grants every action of 1 documented escalation path on any resource with no condition.

    Reads secretsPassRole, new resources3 escalation paths, 1 unrestrictedWhy and how to use it
  • HighAWSGlueConsoleFullAccess

    Can take over existing resources that run as another role

    Grants every action of 1 documented escalation path on any resource with no condition.

    PassRole, new resourcesReads secretsResource policiesService wildcard9 escalation paths, 1 unrestrictedWhy and how to use it
  • HighSecretsManagerReadWrite

    Can launch resources that run as a more privileged role

    Grants every action of 1 documented escalation path on any resource with no condition.

    Reads secretsResource policiesService wildcard1 escalation path, all unrestrictedWhy and how to use it
  • HighAWSDeepRacerServiceRolePolicy

    Can take over existing resources that run as another role

    Grants every action of 2 documented escalation paths on any resource with no condition, and 2 more in a scoped form.

    PassRole, new resourcesService wildcard9 escalation paths, 2 unrestrictedWhy and how to use it
  • HighAWSLambda_FullAccess

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition.

    PassRole, new resourcesReads secretsResource policiesService wildcard6 escalation paths, 3 unrestrictedWhy and how to use it
  • HighAmazonEC2SpotFleetRole

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    PassRole, new resources1 escalation path, all unrestrictedWhy and how to use it
  • HighAmazonSSMMaintenanceWindowRole

    Can take over existing resources that run as another role

    Grants every action of 1 documented escalation path on any resource with no condition.

    Reads secrets1 escalation path, all unrestrictedWhy and how to use it
  • HighAmazonSSMServiceRolePolicy

    Can take over existing resources that run as another role

    Grants every action of 1 documented escalation path on any resource with no condition.

    Reads secrets1 escalation path, all unrestrictedWhy and how to use it
  • HighBedrockAgentCoreFullAccess

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition.

    PassRole, new resourcesService wildcard7 escalation paths, 3 unrestrictedWhy and how to use it
  • HighAmazonLaunchWizardFullaccess

    Can read secrets

    Reads Parameter Store values, SecureString included where the KMS key allows it, on any resource with no condition.

    PassRole, new resourcesPassRole, existing resourcesResource policiesReads all dataService wildcard6 escalation paths, all scopedWhy and how to use it

How the risk is assessed

Every Allow statement is read the way IAM reads it: wildcards such as iam:Put* and NotAction included, and an unconditional Deny in the same policy cancels what it covers. Each capability is then marked unrestricted when it applies to every resource with no condition, or scoped when a resource ARN or a Condition narrows it. That is the difference between IAMFullAccess and a service policy that may only pass its own service role, and it decides the level.

Escalation paths come from the pathfinding.cloud catalog (92 paths, updated Oct 9, 2026), open source by Datadog under Apache-2.0. Permissions management follows the access levels of the AWS Service Authorization Reference, through iam-dataset. Secret reads and monitoring actions are curated lists, named on each policy page.

Admin4 policies
Allows every action (Action "*"), or every action outside a short NotAction list, on every resource.
Use with caution: Keep it for administrator or break-glass roles protected by MFA. Never attach it to a workload, a CI pipeline or a vendor role.
Self-escalation39 policies
Can rewrite or attach IAM policies, so whoever holds it can make itself administrator.
Use with caution: Treat it as administrator access. If it must be used, add a permissions boundary that denies IAM policy writes on your own roles and users.
Identity takeover34 policies
Can create access keys or console passwords for other users, rewrite role trust policies, or assume roles.
Use with caution: Reserve it for identity administrators. Keep role trust policies narrow, since sts:AssumeRole on every role is only as safe as the roles that trust the account.
PassRole, new resources151 policies
Can pass a role to a service and launch something (a function, an instance, a job) that runs with that role's permissions.
Use with caution: Make sure no highly privileged role trusts the service involved, and restrict iam:PassRole in your own policies or boundary to named roles with iam:PassedToService.
PassRole, existing resources144 policies
Can change the code or commands of something that already runs as a role, and so act as that role.
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
Identity admin35 policies
Grants permissions management actions on IAM, IAM Identity Center or Organizations, on every resource.
Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.
Disables monitoring32 policies
Can stop CloudTrail, GuardDuty, Config, Security Hub or other detection, or delete the logs they write.
Use with caution: Deny these actions with an SCP for everyone outside a break-glass role, so no single policy can blind you.
Reads secrets77 policies
Can read Secrets Manager secrets, Parameter Store values, KMS-encrypted data, Lambda environment variables or Glue connection passwords on every resource.
Use with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
Resource policies167 policies
Can write resource policies, grants or shares, which is enough to open a resource to another account or the public.
Use with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
Reads all data53 policies
Can read every S3 object, every DynamoDB table or every Aurora database through the Data API.
Use with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.
Service wildcard320 policies
Uses service:* on every resource with no condition, so each action AWS adds to that service later is granted too.
Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Access Analyzer20 policies
AWS IAM Access Analyzer's own policy validation raises a security warning, like iam:PassRole on every resource.
Use with caution: Read AWS's finding and the documentation it links to.

What this cannot see

Only the policy document is read. Trust policies, permissions boundaries, SCPs and the roles that exist in your account decide whether an escalation actually succeeds, so a flag means the policy grants the actions, not that your account is exploitable. Conditions count as scoping without being evaluated. Many flagged policies are meant for a role an AWS service assumes; there the risk is whoever can control that service.

The same data is published as /api/v1/risk.json for pipelines that want to refuse a critical policy before it is attached. See the API documentation.

Policy validation by IAM Access Analyzer

AWS's own validator, run on every managed policy. 176 policies carry 475 findings. Most are hygiene rather than risk: AWS shipping actions and regions that do not exist. Each policy page lists its findings in full.

Security warnings29 findingsAlso counted in the risk levels above.Show

PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE (3 policies)

AWSMcpServiceActionsFullAccess, AdministratorAccess, IAMFullAccess

Errors169 findingsElements IAM ignores, such as actions or regions that do not exist.Show

INVALID_SERVICE_CONDITION_KEY (1 policy)

AmazonDataZoneGlueManageAccessRolePolicy

INVALID_SERVICE (1 policy)

BatchServiceRolePolicy

Warnings84 findingsStatements that do not do what they appear to.Show

POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA (31 policies)

AIDevOpsAgentAccessPolicy, AIOpsAssistantPolicy, AWSApplicationMigrationNetworkMigrationMultiAccount, AWSBackupServiceRolePolicyForBackup, AWSBackupServiceRolePolicyForRestores, AWSElasticBeanstalkServiceRolePolicy, AWSElasticDisasterRecoveryConsoleFullAccess_v2, AWSFinOpsAgentServiceRolePolicy, AWSObservabilityAdminTelemetryEnablementServiceRolePolicy, AWSTransformNetworkMigrationAgentPolicy, AWSTransformServerMigrationAgentPolicy, AdministratorAccess-Amplify, AmazonDataZoneEnvironmentRolePermissionsBoundary, AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary, AmazonLaunchWizardFullAccessV2, AmazonRDSCustomPreviewServiceRolePolicy, AmazonRDSCustomServiceRolePolicy, AmazonSageMakerCanvasFullAccess, AmazonSageMakerFullAccess, AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy, AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy, CloudWatchOmniAWSIntegrationPolicy, CloudWatchOmniSpaceAccessPolicy, EC2ImageBuilderExecutionPolicy, FMSServiceRolePolicy, SageMakerStudioAdminIAMDefaultExecutionPolicy, SageMakerStudioAdminIAMPermissiveExecutionPolicy, SageMakerStudioUserIAMDefaultExecutionPolicy, SageMakerStudioUserIAMPermissiveExecutionPolicy, ViewOnlyAccess, WellArchitectedAgentResourceScanning

TYPE_MISMATCH (29 policies)

AIOpsAssistantPolicy, AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy, AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy, AWS-SSM-RemediationAutomation-AdministrationRolePolicy, AWS-SSM-RemediationAutomation-ExecutionRolePolicy, AWSDeadlineCloud-UserAccessFarms, AWSObservabilityAdminLogsCentralizationServiceRolePolicy, AWSSSMForSAPServiceLinkedRolePolicy, AWSServiceRoleForAWSTransform, AWSServiceRoleForCodeWhispererPolicy, AWSServiceRoleForMonitronPolicy, AWSServiceRoleForUserSubscriptions, AWSSupplyChainFederationAdminAccess, AWSSystemsManagerChangeManagementServicePolicy, AWSSystemsManagerJustInTimeAccessServicePolicy, AmazonBioDiscoveryFullAccess, AmazonBioDiscoveryInAppFullAccess, AmazonECSInfrastructureRolePolicyForServiceConnectTransportLayerSecurity, AmazonECSInfrastructureRolePolicyForVolumes, AmazonRDSCustomInstanceProfileRolePolicy, AmazonSageMakerNotebooksServiceRolePolicy, CloudWatchLogsAPIKeyAccess, MultiPartyApprovalFullAccess, MultiPartyApprovalReadOnlyAccess, SageMakerStudioBedrockAgentServiceRolePolicy, SageMakerStudioBedrockChatAgentUserRolePolicy, SageMakerStudioBedrockEvaluationJobServiceRolePolicy, SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy, SageMakerStudioBedrockPromptUserRolePolicy

CREATE_SLR_WITH_STAR_IN_ACTION_AND_RESOURCE (3 policies)

AWSMcpServiceActionsFullAccess, AdministratorAccess, IAMFullAccess

Suggestions193 findingsRedundant or simplifiable elements.Show

EQUIVALENT_TO_NULL_FALSE (60 policies)

AWSBackupAccessPointOperatorAccess, AWSBackupGuardDutyRolePolicyForScans, AWSCloud9Administrator, AWSCloud9EnvironmentMember, AWSCloud9User, AWSEC2FleetServiceRolePolicy, AWSEC2SpotFleetServiceRolePolicy, AWSEC2SqlHaInstancePolicy, AWSEC2VssRestorePolicy, AWSEC2VssSnapshotPolicy, AWSElasticBeanstalkEKSTagging, AWSGlueDataBrewServiceRole, AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess, AWSMigrationHubRefactorSpacesFullAccess, AWSMigrationHubRefactorSpacesServiceRolePolicy, AWSQuickSetupDeploymentRolePolicy, AWSQuickSetupDistributorPermissionsBoundary, AWSQuickSetupPatchPolicyDeploymentRolePolicy, AWSQuickSetupPatchPolicyPermissionsBoundary, AWSQuickSetupSSMDeploymentRolePolicy, AWSQuickSetupSSMHostMgmtPermissionsBoundary, AWSSSODirectoryAdministrator, AWSSSODirectoryReadOnly, AWSSSOMasterAccountAdministrator, AWSSSOMemberAccountAdministrator, AWSSSOReadOnly, AWSServiceRoleForAmazonEKSNodegroup, AWSServiceRoleForEC2ScheduledInstances, AWSSupplyChainFederationAdminAccess, AWSThinkboxDeadlineResourceTrackerAccessPolicy, AWSThinkboxDeadlineSpotEventPluginAdminPolicy, AWSTransformApplicationDeploymentPolicy, AWSTransformApplicationECSDeploymentPolicy, AmazonAppStreamPCAAccess, AmazonDataZoneEnvironmentRolePermissionsBoundary, AmazonDocDBElasticFullAccess, AmazonEBSCSIDriverPolicy, AmazonEBSCSIDriverPolicyV2, AmazonEC2RolePolicyForLaunchWizard, AmazonECSServiceRolePolicy, AmazonEKSComputePolicy, AmazonEKSLocalOutpostServiceRolePolicy, AmazonEKSNetworkingPolicy, AmazonEKSServiceRolePolicy, AmazonEVSServiceRolePolicy, AmazonGuardDutyMalwareProtectionServiceRolePolicy, AmazonGuardDutyServiceRolePolicy, AmazonInspector2AgentlessServiceRolePolicy, AmazonMSKFullAccess, AmazonRedshiftDataFullAccess, AmazonRedshiftFullAccess, AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy, AmazonSageMakerNotebooksServiceRolePolicy, AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy, AmazonWorkspacesPCAAccess, AppRunnerNetworkingServiceRolePolicy, EC2FastLaunchServiceRolePolicy, EC2FleetTimeShiftableServiceRolePolicy, FMSServiceRolePolicy, KafkaServiceRolePolicy

REDUNDANT_RESOURCE (31 policies)

AIDevOpsAgentAccessPolicy, AIOpsAssistantPolicy, AWSDeepLensLambdaFunctionAccessPolicy, AWSDeepRacerFullAccess, AWSElasticBeanstalkCustomPlatformforEC2Role, AWSElasticBeanstalkEKSObservability, AWSElasticBeanstalkRoleCore, AWSElasticBeanstalkService, AWSElasticBeanstalkServiceRolePolicy, AWSElasticBeanstalkWebTier, AWSElasticBeanstalkWorkerTier, AWSElementalMediaConnectCreateBridge, AWSElementalMediaConnectCreateFlow, AWSElementalMediaConnectDeleteBridge, AWSElementalMediaConnectDeleteFlow, AWSGlueConsoleFullAccess, AWSMigrationHubOrchestratorConsoleFullAccess, AWSMigrationHubOrchestratorServiceRolePolicy, AWSTransformApplicationDeploymentPolicy, AWSTransformInfrastructureExecutorAccessBatch, AWSTransformInfrastructureExecutorAccessEC2, AWSTransformSecurityAgentExecutorAccess, AmazonCodeGuruReviewerServiceRolePolicy, AmazonLaunchWizardFullAccessV2, AmazonRedshiftAllCommandsFullAccess, AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy, AmazonSageMakerTrainingSessionAccess, AmazonSecurityLakeMetastoreManager, CloudWatchOmniAWSIntegrationPolicy, DBModProvisioningAndMigration, DBModVirtualSource

Finding types are described in the Access Analyzer policy check reference

Continue exploring

Policies

Search all tracked AWS managed policies

Account lookup

Identify the owner of an AWS account ID

Subscribe

Email digest, double opt-in, no account needed