AWSQuickSetupPatchPolicyDeploymentRolePolicy
Last Modified
Sep 4, 2026
September 4, 2026 at 09:03 AM UTC
Version
v2
Total Versions
2
Created
Sep 4, 2026
Actions
73
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PutRolePolicy: condition aws:CalledVia, iam:PermissionsBoundary, on arn:aws:iam::*:role/AWS-QuickSetup-*
- iam:AttachRolePolicy: condition aws:CalledVia, iam:PermissionsBoundary, on arn:aws:iam::*:role/AWS-QuickSetup-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWS-QuickSetup-*
- cloudformation:CreateStack: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*
- cloudformation:CreateChangeSet: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*
- cloudformation:ExecuteChangeSet: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWS-QuickSetup-*
- lambda:CreateFunction: condition aws:CalledVia, aws:ResourceAccount, on arn:aws:lambda:*:*:function:baseline-overrides-*, arn:aws:lambda:*:*:function:delete-name-tags-*
- lambda:InvokeFunction: condition aws:CalledVia, aws:ResourceAccount, on arn:aws:lambda:*:*:function:baseline-overrides-*, arn:aws:lambda:*:*:function:delete-name-tags-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*
- lambda:UpdateFunctionCode (via lambda:UpdateFunction*): condition aws:CalledVia, aws:ResourceAccount, on arn:aws:lambda:*:*:function:baseline-overrides-*, arn:aws:lambda:*:*:function:delete-name-tags-*
- lambda:UpdateFunctionCode (via lambda:UpdateFunction*): condition aws:CalledVia, aws:ResourceAccount, on arn:aws:lambda:*:*:function:baseline-overrides-*, arn:aws:lambda:*:*:function:delete-name-tags-*
- lambda:InvokeFunction: condition aws:CalledVia, aws:ResourceAccount, on arn:aws:lambda:*:*:function:baseline-overrides-*, arn:aws:lambda:*:*:function:delete-name-tags-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:ResourceTag/QuickSetupID in the condition block of StringLike with {aws:ResourceTag/QuickSetupID: false} to ensure better enforcement of the condition. AWS docs
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:ResourceTag/QuickSetupID in the condition block of StringLike with {aws:ResourceTag/QuickSetupID: false} to ensure better enforcement of the condition. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CfnRead",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:ListStacks"
],
"Resource": [
"*"
]
},
{
"Sid": "CfnManage",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackResourceDrifts",
"cloudformation:DetectStackDrift",
"cloudformation:DetectStackResourceDrift"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*"
]
},
{
"Sid": "RGroupsGet",
"Effect": "Allow",
"Action": [
"resource-groups:GetGroupQuery"
],
"Resource": [
"*"
]
},
{
"Sid": "S3BucketsList",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": [
"*"
]
},
{
"Sid": "AccessLogsBucketManage",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:Put*",
"s3:Get*",
"s3:List*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
},
"Resource": [
"arn:aws:s3:::aws-quicksetup-patchpolicy-access-log-*"
]
},
{
"Sid": "LambdaManage",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:UpdateFunction*",
"lambda:GetFunction",
"lambda:ListTags",
"lambda:TagResource",
"lambda:DeleteFunction",
"lambda:InvokeFunction",
"lambda:UntagResource"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": [
"${aws:PrincipalAccount}"
]
}
},
"Resource": [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
]
},
{
"Sid": "LogGroupsDescribe",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups"
],
"Resource": "*"
},
{
"Sid": "LogGroupsManage",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:TagResource",
"logs:PutRetentionPolicy",
"logs:DeleteLogGroup",
"logs:ListTagsForResource",
"logs:UntagResource"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
},
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid": "QSDocsManage",
"Effect": "Allow",
"Action": [
"ssm:CreateDocument",
"ssm:UpdateDocument",
"ssm:DescribeDocument",
"ssm:UpdateDocumentDefaultVersion",
"ssm:DeleteDocument",
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource",
"ssm:ListTagsForResource"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
},
"Resource": [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*"
]
},
{
"Sid": "QSDocsGet",
"Effect": "Allow",
"Action": [
"ssm:GetDocument"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*::document/AWS-RunPatchBaseline"
]
},
{
"Sid": "QSAssociationsManage",
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:DescribeAssociation"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
},
"Resource": [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*::document/AWS-RunPatchBaseline",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid": "SSMSLRCreate",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "ssm.amazonaws.com"
}
}
},
{
"Sid": "ConfigRoleManage",
"Effect": "Allow",
"Action": [
"iam:TagRole",
"iam:UntagRole",
"iam:GetRole",
"iam:UpdateRole",
"iam:DeleteRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:ListRoleTags"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
},
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
]
},
{
"Sid": "ConfigRolePassToSSM",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "ConfigRolePassToLambda",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"lambda.amazonaws.com"
]
}
}
},
{
"Sid": "DocDescribe",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument"
],
"Resource": "*"
},
{
"Sid": "LegacyDocClean",
"Effect": "Allow",
"Action": [
"ssm:DeleteDocument"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:ResourceTag/QuickSetupID": "*"
}
}
},
{
"Sid": "LegacyIAMClean",
"Effect": "Allow",
"Action": [
"iam:DeleteRole",
"iam:DeleteRolePolicy"
],
"Resource": "arn:aws:iam::*:role/*QuickSetup-*",
"Condition": {
"StringLike": {
"aws:ResourceTag/QuickSetupID": "*"
}
}
},
{
"Sid": "ConfigRoleBoundedManage",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:AttachRolePolicy",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:PutRolePolicy",
"iam:PutRolePermissionsBoundary"
],
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
},
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
]
},
{
"Sid": "CfnTagOnMutate",
"Effect": "Allow",
"Action": [
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*"
],
"Condition": {
"StringEquals": {
"cloudformation:CreateAction": [
"CreateStack",
"UpdateStack",
"CreateChangeSet",
"ExecuteChangeSet"
]
}
}
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2026-09-04T08:47:07+00:00"
}
}Version History (4 recorded)
Raw history2 actions added
AWSQuickSetupPatchPolicyDeploymentRolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
a877f3bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 26, 2024
aeb5a72