AWSManagedBudgetsSpendLimitManagementAccess

Last Modified

Aug 7, 2026

August 7, 2026 at 10:03 PM UTC

Version

v2

Total Versions

2

Created

Aug 7, 2026

Actions

7

Subscribe to updates

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • High

    Can change identities and their permissions

    Grants 2 permissions management actions on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    organizations:attachpolicyorganizations:detachpolicy

    Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "SCPActions",
          "Effect": "Allow",
          "Action": [
            "organizations:AttachPolicy",
            "organizations:DescribePolicy",
            "organizations:DetachPolicy"
          ],
          "Resource": "arn:aws:organizations::*:policy/*/service_control_policy/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/ManagedBy": "SpendLimit"
            }
          }
        },
        {
          "Sid": "SCPListPolicyAction",
          "Effect": "Allow",
          "Action": "organizations:ListPolicies",
          "Resource": "*"
        },
        {
          "Sid": "SCPTargetActions",
          "Effect": "Allow",
          "Action": [
            "organizations:AttachPolicy",
            "organizations:DetachPolicy"
          ],
          "Resource": "arn:aws:organizations::*:account/*"
        },
        {
          "Sid": "AccountActions",
          "Effect": "Allow",
          "Action": "organizations:CloseAccount",
          "Resource": "arn:aws:organizations::*:account/*"
        }
      ]
    },
    "VersionId": "v2",
    "IsDefaultVersion": true,
    "CreateDate": "2026-08-07T21:07:17+00:00"
  }
}

Version History (2 recorded)

Raw history
v2updated

scope changed, no action added or removed

45fb963
v1new policy

5 actions added

be8a2c7
1 never-before-seen action: organizations:CloseAccount
2 permissions management, incl. organizations:AttachPolicy: organizations:AttachPolicy, organizations:DetachPolicy