AWSManagementConsoleAdministratorAccess

Last Modified

Mar 31, 2026

March 31, 2026 at 08:44 AM UTC

Version

Total Versions

Created

Mar 23, 2026

Actions

Subscribe to updates

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

Medium
Can rewrite resource policies and sharing
Grants 2 permissions management actions across 1 service (notifications) on any resource, enough to share resources outside the account.
notifications:disablenotificationsaccessfororganizationnotifications:enablenotificationsaccessfororganization
Use with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.

Policy Document

View on GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "uxc:GetAccountColor",
            "uxc:PutAccountColor",
            "uxc:DeleteAccountColor",
            "uxc:GetAccountCustomizations",
            "uxc:UpdateAccountCustomizations",
            "uxc:ListServices",
            "ec2:DescribeRegions",
            "notifications:GetFeatureOptInStatus",
            "notifications:AssociateChannel",
            "notifications:AssociateManagedNotificationAccountContact",
            "notifications:AssociateManagedNotificationAdditionalChannel",
            "notifications:CreateEventRule",
            "notifications:CreateNotificationConfiguration",
            "notifications:DeleteEventRule",
            "notifications:DeleteNotificationConfiguration",
            "notifications:DeregisterNotificationHub",
            "notifications:DisableNotificationsAccessForOrganization",
            "notifications:DisassociateChannel",
            "notifications:DisassociateManagedNotificationAccountContact",
            "notifications:DisassociateManagedNotificationAdditionalChannel",
            "notifications:EnableNotificationsAccessForOrganization",
            "notifications:GetEventRule",
            "notifications:GetManagedNotificationChildEvent",
            "notifications:GetManagedNotificationConfiguration",
            "notifications:GetManagedNotificationEvent",
            "notifications:GetNotificationConfiguration",
            "notifications:GetNotificationEvent",
            "notifications:GetNotificationsAccessForOrganization",
            "notifications:ListChannels",
            "notifications:ListEventRules",
            "notifications:ListManagedNotificationChannelAssociations",
            "notifications:ListManagedNotificationChildEvents",
            "notifications:ListManagedNotificationConfigurations",
            "notifications:ListManagedNotificationEvents",
            "notifications:ListNotificationConfigurations",
            "notifications:ListNotificationEvents",
            "notifications:ListNotificationHubs",
            "notifications:ListTagsForResource",
            "notifications:RegisterNotificationHub",
            "notifications:TagResource",
            "notifications:UntagResource",
            "notifications:UpdateEventRule",
            "notifications:UpdateNotificationConfiguration",
            "cloudshell:CreateEnvironment",
            "cloudshell:CreateSession",
            "cloudshell:GetEnvironmentStatus",
            "cloudshell:DeleteEnvironment",
            "cloudshell:GetFileDownloadUrls",
            "cloudshell:GetFileUploadUrls",
            "cloudshell:DescribeEnvironments",
            "cloudshell:PutCredentials",
            "cloudshell:StartEnvironment",
            "cloudshell:StopEnvironment",
            "cloudshell:ApproveCommand",
            "q:StartConversation",
            "q:SendMessage",
            "q:ListConversations",
            "q:GetConversation",
            "q:PassRequest",
            "resource-explorer-2:AssociateDefaultView",
            "resource-explorer-2:BatchGetView",
            "resource-explorer-2:CreateIndex",
            "resource-explorer-2:CreateView",
            "resource-explorer-2:DeleteIndex",
            "resource-explorer-2:DeleteView",
            "resource-explorer-2:DisassociateDefaultView",
            "resource-explorer-2:GetAccountLevelServiceConfiguration",
            "resource-explorer-2:GetDefaultView",
            "resource-explorer-2:GetIndex",
            "resource-explorer-2:GetManagedView",
            "resource-explorer-2:GetView",
            "resource-explorer-2:ListIndexes",
            "resource-explorer-2:ListIndexesForMembers",
            "resource-explorer-2:ListManagedViews",
            "resource-explorer-2:ListSupportedResourceTypes",
            "resource-explorer-2:ListTagsForResource",
            "resource-explorer-2:ListViews",
            "resource-explorer-2:Search",
            "resource-explorer-2:TagResource",
            "resource-explorer-2:UntagResource",
            "resource-explorer-2:UpdateIndexType",
            "resource-explorer-2:UpdateView",
            "action-recommendations:ListRecommendedActions",
            "account:GetAccountInformation"
          ],
          "Resource": "*"
        }
      ]
    },
    "VersionId": "v7",
    "IsDefaultVersion": true,
    "CreateDate": "2026-03-23T16:42:15+00:00"
  }
}