AWSQuickSetupSSMDeploymentRolePolicy
Last Modified
Sep 7, 2026
September 7, 2026 at 01:04 PM UTC
Version
v9
Total Versions
5
Created
Sep 7, 2026
Actions
63
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition iam:PolicyARN, on arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:AssociatedResourceARN, iam:PassedToService, iam:ResourceTag/QuickSetupDocument, on arn:aws:iam::*:role/AWS-QuickSetup*
- cloudformation:CreateStack: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*
- cloudformation:CreateChangeSet: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*
- cloudformation:ExecuteChangeSet: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*
- iam:PassRole: condition iam:AssociatedResourceARN, iam:PassedToService, iam:ResourceTag/QuickSetupDocument, on arn:aws:iam::*:role/AWS-QuickSetup*
- lambda:CreateFunction: condition aws:CalledVia, aws:RequestTag/QuickSetupDocument, aws:ResourceAccount, aws:ResourceTag/QuickSetupDocument, aws:TagKeys, on arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*
- lambda:InvokeFunction: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/QuickSetupDocument, on arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: on arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*
- lambda:UpdateFunctionCode (via lambda:UpdateFunction*): condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/QuickSetupDocument, on arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*
- lambda:UpdateFunctionCode (via lambda:UpdateFunction*): condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/QuickSetupDocument, on arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*
- lambda:InvokeFunction: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/QuickSetupDocument, on arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:RequestTag/QuickSetupDocumentVersionName in the condition block of StringLike with {aws:RequestTag/QuickSetupDocumentVersionName: false} to ensure better enforcement of the condition. AWS docs
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:RequestTag/QuickSetupDocumentVersionName in the condition block of StringLike with {aws:RequestTag/QuickSetupDocumentVersionName: false} to ensure better enforcement of the condition. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:ListStacks"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackResourceDrifts",
"cloudformation:DetectStackDrift",
"cloudformation:DetectStackResourceDrift",
"cloudformation:DescribeStackEvents"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-SSM-*"
],
"Condition": {
"StringEquals": {
"cloudformation:CreateAction": [
"CreateStack",
"UpdateStack",
"CreateChangeSet",
"ExecuteChangeSet"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:TagResource"
],
"Resource": [
"arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*"
],
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": [
"QuickSetup*"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
],
"aws:ResourceAccount": [
"${aws:PrincipalAccount}"
],
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:DeleteFunction",
"lambda:UpdateFunction*"
],
"Resource": [
"arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": [
"${aws:PrincipalAccount}"
],
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"lambda:GetFunction"
],
"Resource": "arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "cloudformation.amazonaws.com"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:DescribeAssociation",
"ssm:GetDocument",
"ssm:DescribeDocument"
],
"Resource": [
"arn:aws:ssm:*::document/AWSQuickSetupType-EnableAREX",
"arn:aws:ssm:*::document/AWSQuickSetupType-EnableDHMC",
"arn:aws:ssm:*::document/AWSQuickSetupType-ManageInstanceProfile",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*::document/AWS-GatherSoftwareInventory",
"arn:aws:ssm:*::document/AWS-UpdateSSMAgent",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "SSMSLRCreate",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "ssm.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:TagRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-SSM-*",
"arn:aws:iam::*:role/AWS-SSM-Remediation*",
"arn:aws:iam::*:role/AWS-SSM-Diagnosis*"
],
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": [
"QuickSetup*"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:RequestTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
],
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:UpdateRole",
"iam:DeleteRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:ListRoleTags"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-SSM-*",
"arn:aws:iam::*:role/AWS-SSM-Remediation*",
"arn:aws:iam::*:role/AWS-SSM-Diagnosis*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement-*"
],
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/AWSQuickSetupSSMLifecycleManagementExecutionPolicy"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources-*",
"Condition": {
"ArnEquals": {
"iam:PolicyARN": "arn:aws:iam::aws:policy/AWSQuickSetupSSMManageResourcesExecutionPolicy"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/AWS-SSM-Remediation*",
"arn:aws:iam::*:role/AWS-SSM-Diagnosis*"
],
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-AdministrationRolePolicy",
"arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-ExecutionRolePolicy",
"arn:aws:iam::aws:policy/AWS-SSM-RemediationAutomation-OperationalAccountAdministrationRolePolicy",
"arn:aws:iam::aws:policy/AWS-SSM-Automation-DiagnosisBucketPolicy",
"arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-AdministrationRolePolicy",
"arn:aws:iam::aws:policy/AWS-SSM-DiagnosisAutomation-ExecutionRolePolicy"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup*"
],
"Condition": {
"ArnLike": {
"iam:AssociatedResourceARN": [
"arn:aws:ssm:*::document/AWSQuickSetupType-EnableAREX",
"arn:aws:ssm:*::document/AWSQuickSetupType-EnableDHMC",
"arn:aws:ssm:*::document/AWSQuickSetupType-ManageInstanceProfile",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*:*:association/*"
]
},
"StringEquals": {
"iam:PassedToService": "ssm.amazonaws.com",
"iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-SSM-LifecycleManagement*"
],
"Condition": {
"ArnLike": {
"iam:AssociatedResourceARN": [
"arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle-*"
]
},
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com",
"iam:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
}
}
},
{
"Effect": "Allow",
"Action": "lambda:TagResource",
"Resource": [
"arn:aws:lambda:*:*:function:aws-quicksetup-lifecycle*"
],
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "QuickSetup*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "cloudformation.amazonaws.com"
},
"StringEquals": {
"aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
},
"StringLike": {
"aws:RequestTag/QuickSetupDocumentVersionName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:TagRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-SSM-*",
"arn:aws:iam::*:role/AWS-SSM-Remediation*",
"arn:aws:iam::*:role/AWS-SSM-Diagnosis*"
],
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "QuickSetup*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "cloudformation.amazonaws.com"
},
"StringEquals": {
"aws:ResourceTag/QuickSetupDocument": "AWSQuickSetupType-SSM"
},
"StringLike": {
"aws:RequestTag/QuickSetupDocumentVersionName": "*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:AddTagsToResource"
],
"Resource": [
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:DescribeAssociation"
],
"Resource": "arn:aws:ssm:*::document/AWSQuickSetupType-SSM-ManageResources"
},
{
"Effect": "Allow",
"Action": [
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:DescribeAssociation"
],
"Resource": [
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource"
],
"Resource": [
"arn:aws:ssm:*:*:automation-execution/*",
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:DescribeAssociationExecutions",
"ssm:DescribeAssociationExecutionTargets",
"ssm:GetAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:automation-execution/*",
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/AWS-QuickSetup-SSM-ManageResources*",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ssm.amazonaws.com"
],
"iam:ResourceTag/QuickSetupDocument": [
"AWSQuickSetupType-SSM"
]
}
}
}
]
},
"VersionId": "v9",
"IsDefaultVersion": true,
"CreateDate": "2026-09-07T12:27:07+00:00"
}
}Version History (8 recorded)
Raw historyv9updated
2 actions added
AWSQuickSetupSSMDeploymentRolePolicy - Policy Version v8
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
4e48674AWSQuickSetupSSMDeploymentRolePolicy - Policy Version v8
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
a9b4575AWSQuickSetupSSMDeploymentRolePolicy - Policy Version v6
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
189c3d6AWSQuickSetupSSMDeploymentRolePolicy - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Oct 27, 2025
8fe81fcUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 5, 2025
84b3b6dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 20, 2024
7d389e1Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 18, 2024
2631cef