AWSPanoramaServiceLinkedRolePolicy

Last Modified

Mar 12, 2026

March 12, 2026 at 09:26 PM UTC

Version

v1

Total Versions

1

Created

Oct 20, 2021

Actions

28

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Medium

    Can rewrite resource policies and sharing

    Grants 2 permissions management actions across 1 service (iot) on any resource, enough to share resources outside the account.

    iot:attachprincipalpolicyiot:detachprincipalpolicy

    Use with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "PanoramaIoTThingAccess",
          "Effect": "Allow",
          "Action": [
            "iot:CreateThing",
            "iot:DeleteThing",
            "iot:DeleteThingShadow",
            "iot:DescribeThing",
            "iot:GetThingShadow",
            "iot:UpdateThing",
            "iot:UpdateThingShadow"
          ],
          "Resource": [
            "arn:aws:iot:*:*:thing/panorama*"
          ]
        },
        {
          "Sid": "PanoramaIoTCertificateAccess",
          "Effect": "Allow",
          "Action": [
            "iot:AttachThingPrincipal",
            "iot:DetachThingPrincipal",
            "iot:UpdateCertificate",
            "iot:DeleteCertificate",
            "iot:AttachPrincipalPolicy",
            "iot:DetachPrincipalPolicy"
          ],
          "Resource": [
            "arn:aws:iot:*:*:thing/panorama*",
            "arn:aws:iot:*:*:cert/*"
          ]
        },
        {
          "Sid": "PanoramaIoTCreateCertificateAccess",
          "Effect": "Allow",
          "Action": [
            "iot:CreateKeysAndCertificate"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "PanoramaIoTCreatePolicyAndVersionAccess",
          "Effect": "Allow",
          "Action": [
            "iot:CreatePolicy",
            "iot:CreatePolicyVersion",
            "iot:AttachPolicy"
          ],
          "Resource": [
            "arn:aws:iot:*:*:policy/panorama*"
          ]
        },
        {
          "Sid": "PanoramaIoTJobAccess",
          "Effect": "Allow",
          "Action": [
            "iot:DescribeJobExecution",
            "iot:CreateJob",
            "iot:DeleteJob"
          ],
          "Resource": [
            "arn:aws:iot:*:*:job/panorama*",
            "arn:aws:iot:*:*:thing/panorama*"
          ]
        },
        {
          "Sid": "PanoramaIoTEndpointAccess",
          "Effect": "Allow",
          "Action": [
            "iot:DescribeEndpoint"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "PanoramaReadOnlyAccess",
          "Effect": "Allow",
          "Action": [
            "panorama:Describe*",
            "panorama:List*"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "SecretsManagerPermissions",
          "Effect": "Allow",
          "Action": [
            "secretsmanager:GetSecretValue",
            "secretsmanager:DescribeSecret",
            "secretsmanager:CreateSecret",
            "secretsmanager:ListSecretVersionIds",
            "secretsmanager:DeleteSecret"
          ],
          "Resource": [
            "arn:aws:secretsmanager:*:*:secret:panorama*",
            "arn:aws:secretsmanager:*:*:secret:Panorama*"
          ]
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2021-10-20T12:12:50+00:00"
  }
}

Version History (4 recorded)

Raw history

AWSPanoramaServiceLinkedRolePolicy - Policy Version v1

No recorded action delta - this version predates the change index. View the raw diff.

Mar 12, 2026

96c0d9f

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Sep 18, 2024

aafbae9

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

May 13, 2024

1b36617

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Oct 20, 2021

7a7ac88