AWSQuickSetupPatchPolicyPermissionsBoundary
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v5
Total Versions
3
Created
Mar 5, 2026
Actions
54
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can change identities and their permissions
Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.
iam:addroletoinstanceprofileUse with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition aws:PrincipalArn, aws:PrincipalTag/QuickSetupManagerID, iam:PolicyARN, on arn:aws:iam::*:role/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:PrincipalTag/QuickSetupManagerID in the condition block of StringLike with {aws:PrincipalTag/QuickSetupManagerID: false} to ensure better enforcement of the condition. AWS docs
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:PrincipalTag/QuickSetupManagerID in the condition block of StringLike with {aws:PrincipalTag/QuickSetupManagerID: false} to ensure better enforcement of the condition. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "PatchingAutomationRoleGetPermissions",
"Effect": "Allow",
"Action": [
"iam:GetRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
]
},
{
"Sid": "PatchingAutomationRolePassPermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "DefaultInstanceRolePermissions",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:GetRole"
],
"Condition": {
"StringLike": {
"aws:PrincipalTag/QuickSetupManagerID": "*"
},
"ArnLike": {
"aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource": [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid": "DefaultInstanceRolePassPermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com",
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "PoliciesAttachPermissions",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess"
]
},
"StringLike": {
"aws:PrincipalTag/QuickSetupManagerID": "*"
},
"ArnLike": {
"aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource": "arn:aws:iam::*:role/*"
},
{
"Sid": "CreateSLRPermissions",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "ssm.amazonaws.com"
}
}
},
{
"Sid": "InstanceRoleAddPermissions",
"Effect": "Allow",
"Action": [
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"*"
]
},
{
"Sid": "ManagedInstanceRoleUpdatePermissions",
"Effect": "Allow",
"Action": [
"ssm:UpdateManagedInstanceRole"
],
"Resource": "*"
},
{
"Sid": "IAMReadOnlyPermissions",
"Effect": "Allow",
"Action": [
"iam:GetInstanceProfile",
"iam:GetRolePolicy",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles"
],
"Resource": [
"*"
]
},
{
"Sid": "InstanceProfileCreatePermissions",
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid": "InstanceProfileAssociationPermissions",
"Effect": "Allow",
"Action": [
"ec2:AssociateIamInstanceProfile"
],
"Resource": "*",
"Condition": {
"Null": {
"ec2:InstanceProfile": "true"
},
"ArnLike": {
"ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid": "InstanceProfileDisassociationPermissions",
"Effect": "Allow",
"Action": [
"ec2:DisassociateIamInstanceProfile"
],
"Resource": "*",
"Condition": {
"ArnLike": {
"ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid": "SSMAssociationsPermissions",
"Effect": "Allow",
"Action": [
"ssm:DescribeAssociationExecutions",
"ssm:UpdateAssociation",
"ssm:DescribeAssociation"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid": "BaselineS3Permissions",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:Put*",
"s3:Get*",
"s3:List*",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:DeleteBucket"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": [
"${aws:PrincipalAccount}"
]
}
},
"Resource": "arn:aws:s3:::aws-quicksetup-patchpolicy-*"
},
{
"Sid": "PatchingFunctionsPermissions",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction"
],
"Resource": [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": [
"${aws:PrincipalAccount}"
]
}
}
},
{
"Sid": "LoggingPermissions",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid": "SSMTaggingPermissions",
"Effect": "Allow",
"Action": [
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource"
],
"Resource": "arn:aws:ssm:*:*:managed-instance/*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "QSConfigName-*"
}
}
},
{
"Sid": "EC2TaggingPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "QSConfigName-*"
}
}
},
{
"Sid": "RoleTaggingPermissions",
"Effect": "Allow",
"Action": [
"iam:TagRole",
"iam:UntagRole"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "QSConfigId-*"
}
}
},
{
"Sid": "PatchingReadOnlyPermissions",
"Effect": "Allow",
"Action": [
"ssm:GetPatchBaseline",
"ssm:GetInventory",
"ssm:DescribeInstanceInformation",
"ssm:DescribeAssociation",
"ssm:GetAutomationExecution",
"ssm:ListTagsForResource",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances"
],
"Resource": "*"
},
{
"Sid": "PatchingAutomationsStartPermissions",
"Effect": "Allow",
"Action": [
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:automation-definition/QuickSetup-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:document/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:document/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:automation-execution/*"
]
},
{
"Sid": "ReadOnlyPermissionsForEnablingExplorer",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"config:DescribeConfigurationRecorders",
"compute-optimizer:GetEnrollmentStatus",
"support:DescribeTrustedAdvisorChecks"
],
"Resource": "*"
},
{
"Sid": "ExplorerServiceSettingsPermissions",
"Effect": "Allow",
"Action": [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting"
],
"Resource": [
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager",
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
]
}
]
},
"VersionId": "v5",
"IsDefaultVersion": true,
"CreateDate": "2026-03-05T16:57:14+00:00"
}
}Version History (7 recorded)
Raw historyAWSQuickSetupPatchPolicyPermissionsBoundary - Policy Version v5
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
cc0b9f5AWSQuickSetupPatchPolicyPermissionsBoundary - Policy Version v5
No recorded action delta - this version predates the change index. View the raw diff.
Mar 5, 2026
2a12b6fAWSQuickSetupPatchPolicyPermissionsBoundary - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
33d7e24AWSQuickSetupPatchPolicyPermissionsBoundary - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
bbb22e0AWSQuickSetupPatchPolicyPermissionsBoundary - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Sep 12, 2025
88b3674Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 26, 2024
aeb5a72