Deprecated

Removed from AWS on 2021-04-02 - Active for 6 years, 2 months

AWSOpsWorksRegisterCLI

Last Modified

Feb 10, 2019

February 10, 2019 at 06:13 PM UTC

Version

v1

Total Versions

1

Created

Feb 6, 2015

Actions

16

Subscribe to updates

Risk

Critical

Administrator access, or an unrestricted way to grant itself permissions or take over other identities. Treat it as admin. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Critical

    Can grant itself more permissions

    Grants every action of 2 documented escalation paths on any resource with no condition.

    • iam-007iam:PutUserPolicyunrestricted
    • iam-013iam:AddUserToGroupunrestricted

    Use with caution: Treat it as administrator access. If it must be used, add a permissions boundary that denies IAM policy writes on your own roles and users.

  • Critical

    Can take over other users or roles

    Grants every action of 2 documented escalation paths on any resource with no condition.

    • iam-002iam:CreateAccessKeyunrestricted
    • iam-018iam:PutUserPolicy + iam:CreateAccessKeyunrestricted

    Use with caution: Reserve it for identity administrators. Keep role trust policies narrow, since sts:AssumeRole on every role is only as safe as the roles that trust the account.

  • High

    Can change identities and their permissions

    Grants 6 permissions management actions on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    iam:addusertogroupiam:createaccesskeyiam:creategroupiam:createuseriam:passroleiam:putuserpolicy

    Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "CreateDate": "2015-02-06T18:40:49Z",
    "VersionId": "v1",
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
            "opsworks:AssignInstance",
            "opsworks:CreateStack",
            "opsworks:CreateLayer",
            "opsworks:DeregisterInstance",
            "opsworks:DescribeInstances",
            "opsworks:DescribeStackProvisioningParameters",
            "opsworks:DescribeStacks",
            "opsworks:UnassignInstance"
          ],
          "Resource": [
            "*"
          ],
          "Effect": "Allow"
        },
        {
          "Action": [
            "ec2:DescribeInstances"
          ],
          "Resource": [
            "*"
          ],
          "Effect": "Allow"
        },
        {
          "Action": [
            "iam:AddUserToGroup",
            "iam:CreateAccessKey",
            "iam:CreateGroup",
            "iam:CreateUser",
            "iam:ListInstanceProfiles",
            "iam:PassRole",
            "iam:PutUserPolicy"
          ],
          "Resource": [
            "*"
          ],
          "Effect": "Allow"
        }
      ]
    },
    "IsDefaultVersion": true
  }
}

Version History (1 recorded)

Raw history

First commit

No recorded action delta - this version predates the change index. View the raw diff.

Feb 10, 2019

ad4c2e8