AWSPanoramaServiceLinkedRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v1
Total Versions
1
Created
Oct 20, 2021
Actions
28
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 2 permissions management actions across 1 service (iot) on any resource, enough to share resources outside the account.
iot:attachprincipalpolicyiot:detachprincipalpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PanoramaIoTThingAccess",
"Effect": "Allow",
"Action": [
"iot:CreateThing",
"iot:DeleteThing",
"iot:DeleteThingShadow",
"iot:DescribeThing",
"iot:GetThingShadow",
"iot:UpdateThing",
"iot:UpdateThingShadow"
],
"Resource": [
"arn:aws:iot:*:*:thing/panorama*"
]
},
{
"Sid": "PanoramaIoTCertificateAccess",
"Effect": "Allow",
"Action": [
"iot:AttachThingPrincipal",
"iot:DetachThingPrincipal",
"iot:UpdateCertificate",
"iot:DeleteCertificate",
"iot:AttachPrincipalPolicy",
"iot:DetachPrincipalPolicy"
],
"Resource": [
"arn:aws:iot:*:*:thing/panorama*",
"arn:aws:iot:*:*:cert/*"
]
},
{
"Sid": "PanoramaIoTCreateCertificateAccess",
"Effect": "Allow",
"Action": [
"iot:CreateKeysAndCertificate"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaIoTCreatePolicyAndVersionAccess",
"Effect": "Allow",
"Action": [
"iot:CreatePolicy",
"iot:CreatePolicyVersion",
"iot:AttachPolicy"
],
"Resource": [
"arn:aws:iot:*:*:policy/panorama*"
]
},
{
"Sid": "PanoramaIoTJobAccess",
"Effect": "Allow",
"Action": [
"iot:DescribeJobExecution",
"iot:CreateJob",
"iot:DeleteJob"
],
"Resource": [
"arn:aws:iot:*:*:job/panorama*",
"arn:aws:iot:*:*:thing/panorama*"
]
},
{
"Sid": "PanoramaIoTEndpointAccess",
"Effect": "Allow",
"Action": [
"iot:DescribeEndpoint"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaReadOnlyAccess",
"Effect": "Allow",
"Action": [
"panorama:Describe*",
"panorama:List*"
],
"Resource": [
"*"
]
},
{
"Sid": "SecretsManagerPermissions",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret",
"secretsmanager:CreateSecret",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:DeleteSecret"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:panorama*",
"arn:aws:secretsmanager:*:*:secret:Panorama*"
]
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2021-10-20T12:12:50+00:00"
}
}Version History (4 recorded)
Raw historyAWSPanoramaServiceLinkedRolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
96c0d9fUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 20, 2021
7a7ac88