AWSElasticDisasterRecoveryConsoleFullAccess_v2
Last Modified
Jun 18, 2026
June 18, 2026 at 11:02 PM UTC
Version
v10
Total Versions
6
Created
Jun 18, 2026
Actions
88
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole, arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole, arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole
- ec2:RunInstances: condition aws:RequestTag/AWSElasticDisasterRecoveryManaged, aws:ViaAWSService, on arn:aws:ec2:*:*:instance/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 4 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ec2:ModifyInstanceAttribute: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, aws:ViaAWSService, on arn:aws:ec2:*:*:instance/*
- ec2:StopInstances: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, aws:ViaAWSService, on arn:aws:ec2:*:*:instance/*
- ec2:StartInstances: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, aws:ViaAWSService, on arn:aws:ec2:*:*:instance/*
- ec2:CreateLaunchTemplateVersion: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, on arn:aws:ec2:*:*:launch-template/*
- ec2:ModifyLaunchTemplate: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, on arn:aws:ec2:*:*:launch-template/*
- ec2:CreateLaunchTemplateVersion: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, on arn:aws:ec2:*:*:launch-template/*
- ec2:ModifyLaunchTemplate: condition aws:ResourceTag/AWSElasticDisasterRecoveryManaged, on arn:aws:ec2:*:*:launch-template/*
- ssm:SendCommand: condition aws:CalledVia, on arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT, arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity, arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Full drs access on every resource
Uses drs:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
drs:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 11476 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ConsoleFullAccess1",
"Effect": "Allow",
"Action": [
"drs:*"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess2",
"Effect": "Allow",
"Action": [
"kms:ListAliases",
"kms:DescribeKey"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess3",
"Effect": "Allow",
"Action": [
"ec2:DescribeAccountAttributes",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeVolumes",
"ec2:GetEbsEncryptionByDefault",
"ec2:GetEbsDefaultKmsKeyId",
"ec2:DescribeKeyPairs",
"ec2:DescribeCapacityReservations",
"ec2:DescribeHosts",
"ec2:GetInstanceTypesFromInstanceRequirements"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess4",
"Effect": "Allow",
"Action": "license-manager:ListLicenseConfigurations",
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess5",
"Effect": "Allow",
"Action": "resource-groups:ListGroups",
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess6",
"Effect": "Allow",
"Action": "elasticloadbalancing:DescribeLoadBalancers",
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess7",
"Effect": "Allow",
"Action": [
"iam:ListInstanceProfiles",
"iam:ListRoles"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess8",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryConversionServerRole",
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceRole",
"arn:aws:iam::*:role/service-role/AWSElasticDisasterRecoveryRecoveryInstanceWithLaunchActionsRole"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Sid": "ConsoleFullAccess9",
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess10",
"Effect": "Allow",
"Action": [
"ec2:CreateLaunchTemplateVersion",
"ec2:ModifyLaunchTemplate",
"ec2:DeleteLaunchTemplateVersions",
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:launch-template/*",
"Condition": {
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess11",
"Effect": "Allow",
"Action": [
"ec2:CreateLaunchTemplate"
],
"Resource": "arn:aws:ec2:*:*:launch-template/*",
"Condition": {
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess12",
"Effect": "Allow",
"Action": [
"ec2:DeleteVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess13",
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ec2:ModifyInstanceAttribute",
"ec2:GetConsoleOutput",
"ec2:GetConsoleScreenshot"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess14",
"Effect": "Allow",
"Action": [
"ec2:RevokeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess15",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess16",
"Effect": "Allow",
"Action": "ec2:CreateSecurityGroup",
"Resource": "arn:aws:ec2:*:*:vpc/*"
},
{
"Sid": "ConsoleFullAccess17",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess18",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess19",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess20",
"Effect": "Allow",
"Action": [
"ec2:DetachVolume",
"ec2:AttachVolume"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess21",
"Effect": "Allow",
"Action": [
"ec2:DetachVolume",
"ec2:AttachVolume",
"ec2:StartInstances",
"ec2:GetConsoleOutput",
"ec2:GetConsoleScreenshot"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
},
"StringEquals": {
"ec2:ResourceTag/AWSDRS": "AllowLaunchingIntoThisInstance"
}
}
},
{
"Sid": "ConsoleFullAccess22",
"Effect": "Allow",
"Action": [
"ec2:AttachVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"ec2:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess23",
"Effect": "Allow",
"Action": [
"ec2:DetachVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "ConsoleFullAccess24",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess25",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:image/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:launch-template/*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
}
}
},
{
"Sid": "ConsoleFullAccess26",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"StringEquals": {
"ec2:CreateAction": [
"CreateSecurityGroup",
"CreateVolume",
"CreateSnapshot",
"RunInstances",
"CreateNetworkInterface"
]
}
}
},
{
"Sid": "ConsoleFullAccess27",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*:*:launch-template/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"CreateLaunchTemplate"
]
}
}
},
{
"Sid": "ConsoleFullAccess28",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:ListStacks"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess29",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess30",
"Effect": "Allow",
"Action": [
"ssm:DescribeInstanceInformation",
"ssm:DescribeParameters"
],
"Resource": [
"*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
}
}
},
{
"Sid": "ConsoleFullAccess31",
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:automation-definition/AWS-CreateImage:$DEFAULT",
"arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity",
"arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes",
"arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse",
"arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace",
"arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning",
"arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting",
"arn:aws:ssm:*:*:document/AWSDRS-ValidateNetworkConnectivity",
"arn:aws:ssm:*:*:document/AWSDRS-VerifyMountedVolumes",
"arn:aws:ssm:*:*:document/AWSDRS-ValidateHttpResponse",
"arn:aws:ssm:*:*:document/AWSDRS-ValidateDiskSpace",
"arn:aws:ssm:*:*:document/AWSDRS-VerifyProcessIsRunning",
"arn:aws:ssm:*:*:document/AWSDRS-LinuxTimeSyncSetting",
"arn:aws:ssm:*:*:document/AWSDRS-InstallDRAgentOnInstance",
"arn:aws:ssm:*:*:document/AWSDRS-VerifyTags",
"arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure",
"arn:aws:ssm:*:*:automation-execution/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
}
}
},
{
"Sid": "ConsoleFullAccess32",
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess33",
"Effect": "Allow",
"Action": [
"ssm:ListDocuments",
"ssm:ListCommandInvocations"
],
"Resource": "*"
},
{
"Sid": "ConsoleFullAccess34",
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecoveryService-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ConsoleFullAccess35",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument",
"ssm:GetDocument"
],
"Resource": "arn:aws:ssm:*:*:document/*"
},
{
"Sid": "ConsoleFullAccess36",
"Effect": "Allow",
"Action": [
"ssm:GetParameters"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "ssm.amazonaws.com"
}
}
},
{
"Sid": "ConsoleFullAccess37",
"Effect": "Allow",
"Action": [
"ssm:GetAutomationExecution"
],
"Resource": "arn:aws:ssm:*:*:automation-execution/*",
"Condition": {
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess38",
"Effect": "Allow",
"Action": [
"ec2:AssociateIamInstanceProfile"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess39",
"Effect": "Allow",
"Action": "ec2:CreateFleet",
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:fleet/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:image/*",
"arn:aws:ec2:*:*:launch-template/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
}
}
},
{
"Sid": "ConsoleFullAccess40",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"drs.amazonaws.com"
]
},
"StringEquals": {
"ec2:CreateAction": [
"CreateFleet"
]
}
}
},
{
"Sid": "ConsoleFullAccess41",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess42",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:RequestTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
},
{
"Sid": "ConsoleFullAccess43",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
]
},
{
"Sid": "ConsoleFullAccess44",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterfacePermission"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"Null": {
"aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
}
}
}
]
},
"VersionId": "v10",
"IsDefaultVersion": true,
"CreateDate": "2026-06-18T22:57:18+00:00"
}
}Version History (11 recorded)
Raw historyv10updated
scope changed, no action added or removed
AWSElasticDisasterRecoveryConsoleFullAccess_v2 - Policy Version v9
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
42a3a90AWSElasticDisasterRecoveryConsoleFullAccess_v2 - Policy Version v9
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
eb8f67cAWSElasticDisasterRecoveryConsoleFullAccess_v2 - Policy Version v7
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
0daf821Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 2, 2025
1e3ab1eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 5, 2025
851d421Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 29, 2024
42fe169Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 20, 2024
1884c3bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 27, 2023
dd0483b