AWSManagedServiceAccessManagementAccess

Last Modified

Jul 21, 2026

July 21, 2026 at 06:03 PM UTC

Version

v1

Total Versions

1

Created

Jul 21, 2026

Actions

8

Subscribe to updates

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • High

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    organizations:attachpolicy

    Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowListRoots",
          "Effect": "Allow",
          "Action": "organizations:ListRoots",
          "Resource": "*"
        },
        {
          "Sid": "AllowSCPList",
          "Effect": "Allow",
          "Action": [
            "organizations:ListPolicies",
            "organizations:ListPoliciesForTarget"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "organizations:PolicyType": "SERVICE_CONTROL_POLICY"
            }
          }
        },
        {
          "Sid": "AllowSCPCreateWithTag",
          "Effect": "Allow",
          "Action": [
            "organizations:CreatePolicy",
            "organizations:TagResource"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "organizations:PolicyType": "SERVICE_CONTROL_POLICY",
              "aws:RequestTag/ManagedBy": "service-access"
            }
          }
        },
        {
          "Sid": "AllowSCPUpdateTagged",
          "Effect": "Allow",
          "Action": "organizations:UpdatePolicy",
          "Resource": "arn:aws:organizations::*:policy/*/service_control_policy/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/ManagedBy": "service-access"
            }
          }
        },
        {
          "Sid": "AllowSCPAttachTaggedPolicy",
          "Effect": "Allow",
          "Action": "organizations:AttachPolicy",
          "Resource": "arn:aws:organizations::*:policy/*/service_control_policy/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/ManagedBy": "service-access"
            }
          }
        },
        {
          "Sid": "AllowSCPAttachRoot",
          "Effect": "Allow",
          "Action": "organizations:AttachPolicy",
          "Resource": "arn:aws:organizations::*:root/*"
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2026-07-21T17:57:17+00:00"
  }
}

Version History (1 recorded)

Raw history
v1new policy

7 actions added

68825c3
2 permissions management, incl. organizations:AttachPolicy: organizations:AttachPolicy, organizations:UpdatePolicy