AWSPanoramaServiceRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v1
Total Versions
1
Created
Dec 1, 2020
Actions
113
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWSPanoramaSageMakerRole, arn:aws:iam::*:role/service-role/AWSPanoramaSageMakerRole
- sagemaker:CreateTrainingJob: on arn:aws:sagemaker:*:*:training-job/panorama*, arn:aws:sagemaker:*:*:compilation-job/panorama*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can read secrets
Reads Lambda environment variables, where credentials often live, on any resource with no condition.
lambda:GetFunctionConfigurationUse with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
- Medium
Can rewrite resource policies and sharing
Grants 3 permissions management actions across 1 service (iot) on any resource, enough to share resources outside the account.
iot:attachprincipalpolicyiot:createpolicyiot:detachprincipalpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PanoramaIoTThingAccess",
"Effect": "Allow",
"Action": [
"iot:CreateThing",
"iot:DeleteThing",
"iot:DeleteThingShadow",
"iot:DescribeThing",
"iot:GetThingShadow",
"iot:UpdateThing",
"iot:UpdateThingShadow"
],
"Resource": [
"arn:aws:iot:*:*:thing/panorama*"
]
},
{
"Sid": "PanoramaIoTCertificateAccess",
"Effect": "Allow",
"Action": [
"iot:AttachThingPrincipal",
"iot:DetachThingPrincipal",
"iot:UpdateCertificate",
"iot:DeleteCertificate",
"iot:AttachPrincipalPolicy",
"iot:DetachPrincipalPolicy"
],
"Resource": [
"arn:aws:iot:*:*:thing/panorama*",
"arn:aws:iot:*:*:cert/*"
]
},
{
"Sid": "PanoramaIoTCreateCertificateAndPolicyAccess",
"Effect": "Allow",
"Action": [
"iot:CreateKeysAndCertificate",
"iot:CreatePolicy"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaIoTCreatePolicyVersionAccess",
"Effect": "Allow",
"Action": [
"iot:CreatePolicyVersion"
],
"Resource": [
"arn:aws:iot:*:*:policy/panorama*"
]
},
{
"Sid": "PanoramaIoTJobAccess",
"Effect": "Allow",
"Action": [
"iot:DescribeJobExecution",
"iot:CreateJob",
"iot:DeleteJob"
],
"Resource": [
"arn:aws:iot:*:*:job/panorama*",
"arn:aws:iot:*:*:thing/panorama*"
]
},
{
"Sid": "PanoramaIoTEndpointAccess",
"Effect": "Allow",
"Action": [
"iot:DescribeEndpoint"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaAccess",
"Effect": "Allow",
"Action": [
"panorama:Describe*",
"panorama:List*",
"panorama:Get*"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaS3Access",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:ListBucket",
"s3:GetBucket*",
"s3:CreateBucket"
],
"Resource": [
"arn:aws:s3:::*aws-panorama*"
]
},
{
"Sid": "PanoramaIAMPassSageMakerRoleAccess",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWSPanoramaSageMakerRole",
"arn:aws:iam::*:role/service-role/AWSPanoramaSageMakerRole"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"sagemaker.amazonaws.com"
]
}
}
},
{
"Sid": "PanoramaIAMPassGreengrassRoleAccess",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWSPanoramaGreengrassGroupRole",
"arn:aws:iam::*:role/service-role/AWSPanoramaGreengrassGroupRole",
"arn:aws:iam::*:role/AWSPanoramaGreengrassRole",
"arn:aws:iam::*:role/service-role/AWSPanoramaGreengrassRole"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"greengrass.amazonaws.com"
]
}
}
},
{
"Sid": "PanoramaIAMPassIoTRoleAccess",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWSPanoramaApplianceRole",
"arn:aws:iam::*:role/service-role/AWSPanoramaApplianceRole"
],
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": "iot.amazonaws.com"
}
}
},
{
"Sid": "PanoramaGreenGrassAccess",
"Effect": "Allow",
"Action": [
"greengrass:AssociateRoleToGroup",
"greengrass:AssociateServiceRoleToAccount",
"greengrass:CreateResourceDefinition",
"greengrass:CreateResourceDefinitionVersion",
"greengrass:CreateCoreDefinition",
"greengrass:CreateCoreDefinitionVersion",
"greengrass:CreateDeployment",
"greengrass:CreateFunctionDefinition",
"greengrass:CreateFunctionDefinitionVersion",
"greengrass:CreateGroup",
"greengrass:CreateGroupCertificateAuthority",
"greengrass:CreateGroupVersion",
"greengrass:CreateLoggerDefinition",
"greengrass:CreateLoggerDefinitionVersion",
"greengrass:CreateSubscriptionDefinition",
"greengrass:CreateSubscriptionDefinitionVersion",
"greengrass:DeleteCoreDefinition",
"greengrass:DeleteFunctionDefinition",
"greengrass:DeleteResourceDefinition",
"greengrass:DeleteGroup",
"greengrass:DeleteLoggerDefinition",
"greengrass:DeleteSubscriptionDefinition",
"greengrass:DisassociateRoleFromGroup",
"greengrass:DisassociateServiceRoleFromAccount",
"greengrass:GetAssociatedRole",
"greengrass:GetConnectivityInfo",
"greengrass:GetCoreDefinition",
"greengrass:GetCoreDefinitionVersion",
"greengrass:GetDeploymentStatus",
"greengrass:GetDeviceDefinition",
"greengrass:GetDeviceDefinitionVersion",
"greengrass:GetFunctionDefinition",
"greengrass:GetFunctionDefinitionVersion",
"greengrass:GetGroup",
"greengrass:GetGroupCertificateAuthority",
"greengrass:GetGroupCertificateConfiguration",
"greengrass:GetGroupVersion",
"greengrass:GetLoggerDefinition",
"greengrass:GetLoggerDefinitionVersion",
"greengrass:GetResourceDefinition",
"greengrass:GetServiceRoleForAccount",
"greengrass:GetSubscriptionDefinition",
"greengrass:GetSubscriptionDefinitionVersion",
"greengrass:ListCoreDefinitionVersions",
"greengrass:ListCoreDefinitions",
"greengrass:ListDeployments",
"greengrass:ListDeviceDefinitionVersions",
"greengrass:ListDeviceDefinitions",
"greengrass:ListFunctionDefinitionVersions",
"greengrass:ListFunctionDefinitions",
"greengrass:ListGroupCertificateAuthorities",
"greengrass:ListGroupVersions",
"greengrass:ListGroups",
"greengrass:ListLoggerDefinitionVersions",
"greengrass:ListLoggerDefinitions",
"greengrass:ListSubscriptionDefinitionVersions",
"greengrass:ListSubscriptionDefinitions",
"greengrass:ResetDeployments",
"greengrass:UpdateConnectivityInfo",
"greengrass:UpdateCoreDefinition",
"greengrass:UpdateDeviceDefinition",
"greengrass:UpdateFunctionDefinition",
"greengrass:UpdateGroup",
"greengrass:UpdateGroupCertificateConfiguration",
"greengrass:UpdateLoggerDefinition",
"greengrass:UpdateSubscriptionDefinition",
"greengrass:UpdateResourceDefinition"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaLambdaUsersFunctionAccess",
"Effect": "Allow",
"Action": [
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:ListFunctions",
"lambda:ListVersionsByFunction"
],
"Resource": [
"arn:aws:lambda:*:*:function:*"
]
},
{
"Sid": "PanoramaSageMakerWriteAccess",
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:StopTrainingJob",
"sagemaker:CreateCompilationJob",
"sagemaker:DescribeCompilationJob",
"sagemaker:StopCompilationJob"
],
"Resource": [
"arn:aws:sagemaker:*:*:training-job/panorama*",
"arn:aws:sagemaker:*:*:compilation-job/panorama*"
]
},
{
"Sid": "PanoramaSageMakerListAccess",
"Effect": "Allow",
"Action": [
"sagemaker:ListCompilationJobs"
],
"Resource": [
"*"
]
},
{
"Sid": "PanoramaSageMakerReadAccess",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeTrainingJob"
],
"Resource": [
"arn:aws:sagemaker:*:*:training-job/*"
]
},
{
"Sid": "PanoramaCWLogsAccess",
"Effect": "Allow",
"Action": [
"iot:AttachPolicy",
"iot:CreateRoleAlias"
],
"Resource": [
"arn:aws:iot:*:*:policy/panorama*",
"arn:aws:iot:*:*:rolealias/panorama*"
]
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2020-12-01T13:14:43+00:00"
}
}Version History (4 recorded)
Raw historyAWSPanoramaServiceRolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
3418820Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 1, 2020
7075032