AWSQuickSetupSSMHostMgmtPermissionsBoundary
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v1
Total Versions
1
Created
Jun 26, 2024
Actions
29
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can change identities and their permissions
Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.
iam:addroletoinstanceprofileUse with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:AttachRolePolicy: condition aws:PrincipalArn, aws:PrincipalTag/QuickSetupManagerID, iam:PolicyARN, on arn:aws:iam::*:role/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:PrincipalTag/QuickSetupManagerID in the condition block of StringLike with {aws:PrincipalTag/QuickSetupManagerID: false} to ensure better enforcement of the condition. AWS docs
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:PrincipalTag/QuickSetupManagerID in the condition block of StringLike with {aws:PrincipalTag/QuickSetupManagerID: false} to ensure better enforcement of the condition. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "HostManagementAutomationRoleGetPermissions",
"Effect": "Allow",
"Action": [
"iam:GetRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*"
]
},
{
"Sid": "HostManagementAutomationRolePassPermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "DefaultInstanceRoleManagePermissions",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:GetRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition": {
"StringLike": {
"aws:PrincipalTag/QuickSetupManagerID": "*"
},
"ArnLike": {
"aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*"
}
}
},
{
"Sid": "DefaultInstanceRolePassToEC2Permissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com"
]
}
}
},
{
"Sid": "DefaultInstanceRolePassToSSMPermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "InstanceManagementPoliciesAttachPermissions",
"Effect": "Allow",
"Action": [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Condition": {
"ArnEquals": {
"iam:PolicyARN": [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/AmazonSSMPatchAssociation"
]
},
"StringLike": {
"aws:PrincipalTag/QuickSetupManagerID": "*"
},
"ArnLike": {
"aws:PrincipalArn": "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*"
}
},
"Resource": "arn:aws:iam::*:role/*"
},
{
"Sid": "CreateSystemsManagerSLRPermissions",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "ssm.amazonaws.com"
}
}
},
{
"Sid": "DefaultInstanceRoleAddPermissions",
"Effect": "Allow",
"Action": [
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"*"
]
},
{
"Sid": "IAMReadOnlyPermissions",
"Effect": "Allow",
"Action": [
"iam:GetInstanceProfile",
"iam:GetRolePolicy",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles"
],
"Resource": [
"*"
]
},
{
"Sid": "DefaultInstanceProfileCreatePermissions",
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid": "DefaultInstanceProfileAssociationPermissions",
"Effect": "Allow",
"Action": [
"ec2:AssociateIamInstanceProfile"
],
"Resource": "*",
"Condition": {
"Null": {
"ec2:InstanceProfile": "true"
},
"ArnLike": {
"ec2:NewInstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid": "DefaultInstanceProfileDisassociationPermissions",
"Effect": "Allow",
"Action": [
"ec2:DisassociateIamInstanceProfile"
],
"Resource": "*",
"Condition": {
"ArnLike": {
"ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid": "ConfigurationAutomationsStartPermissions",
"Effect": "Allow",
"Action": [
"ssm:StartAutomationExecution"
],
"Resource": [
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-HostMgmt-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-CreateAndAttachIAMToInstance-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-UpdateExistingInstanceProfile-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-InstallAndManageCloudWatchDocument-*",
"arn:aws:ssm:*:*:automation-definition/UpdateCloudWatchDocument-*",
"arn:aws:ssm:*:*:automation-definition/AWSEC2-UpdateLaunchAgent-*",
"arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:automation-definition/AWS-GatherSoftwareInventory*",
"arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaselineAssociation*",
"arn:aws:ssm:*:*:automation-definition/AWS-UpdateSSMAgent*"
]
},
{
"Sid": "ReadOnlyPermissionsForEnablingHostManagementBySSM",
"Effect": "Allow",
"Action": [
"ssm:ListTagsForResource",
"ssm:GetAutomationExecution",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances"
],
"Resource": "*"
},
{
"Sid": "ReadOnlyPermissionsForEnablingExplorer",
"Effect": "Allow",
"Action": [
"config:DescribeConfigurationRecorders",
"compute-optimizer:GetEnrollmentStatus",
"support:DescribeTrustedAdvisorChecks"
],
"Resource": "*"
},
{
"Sid": "SSMExplorerServiceSettingsPermissions",
"Effect": "Allow",
"Action": [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting"
],
"Resource": [
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager",
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
]
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2024-06-26T09:48:42+00:00"
}
}Version History (3 recorded)
Raw historyAWSQuickSetupSSMHostMgmtPermissionsBoundary - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
9a4bdf2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 26, 2024
aeb5a72