AWSResilienceHubV2AssessmentExecutionPolicy
Last Modified
Jun 17, 2026
June 17, 2026 at 11:02 PM UTC
Version
v1
Total Versions
1
Created
Jun 17, 2026
Actions
219
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can read secrets
Reads Parameter Store values, SecureString included where the KMS key allows it; Lambda environment variables, where credentials often live, on any resource with no condition.
ssm:GetParameterslambda:GetFunctionConfigurationUse with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSResilienceHubV2ReadResourceConfigStatement",
"Effect": "Allow",
"Action": [
"acm:Describe*",
"acm:List*",
"application-autoscaling:Describe*",
"application-autoscaling:GetPredictiveScalingForecast",
"application-autoscaling:ListTagsForResource",
"arc-region-switch:Get*",
"arc-region-switch:List*",
"arc-zonal-shift:Get*",
"arc-zonal-shift:List*",
"autoscaling:Describe*",
"autoscaling:GetPredictiveScalingForecast",
"backup:Describe*",
"backup:GetBackupPlan",
"backup:GetBackupSelection",
"backup:GetBackupVaultAccessPolicy",
"backup:GetBackupVaultNotifications",
"backup:GetRestoreTestingPlan",
"backup:GetRestoreTestingSelection",
"backup:List*",
"cloudformation:Describe*",
"cloudformation:GetResource",
"cloudformation:GetStackPolicy",
"cloudformation:GetTemplate",
"cloudformation:List*",
"cloudfront:Get*",
"cloudfront:List*",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"config:Describe*",
"config:GetStoredQuery",
"config:List*",
"datasync:Describe*",
"datasync:List*",
"dlm:Get*",
"docdb-elastic:Get*",
"docdb-elastic:List*",
"drs:Describe*",
"drs:Get*",
"drs:List*",
"ds:Describe*",
"dsql:Get*",
"dsql:List*",
"dynamodb:Describe*",
"dynamodb:GetResourcePolicy",
"dynamodb:List*",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCapacityReservations",
"ec2:DescribeClientVpnConnections",
"ec2:DescribeClientVpnEndpoints",
"ec2:DescribeCustomerGateways",
"ec2:DescribeDhcpOptions",
"ec2:DescribeFastSnapshotRestores",
"ec2:DescribeFleets",
"ec2:DescribeFlowLogs",
"ec2:DescribeHosts",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInternetGateways",
"ec2:DescribeKeyPairs",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeManagedPrefixLists",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInsightsAnalyses",
"ec2:DescribeNetworkInsightsPaths",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePlacementGroups",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayPeeringAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGateways",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeVolumes",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcEndpointConnectionNotifications",
"ec2:DescribeVpcEndpointConnections",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpointServicePermissions",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:GetTransitGatewayRouteTableAssociations",
"ecr:Describe*",
"ecs:Describe*",
"ecs:List*",
"eks:Describe*",
"eks:List*",
"elasticache:Describe*",
"elasticache:List*",
"elasticfilesystem:Describe*",
"elasticfilesystem:ListTagsForResource",
"elasticloadbalancing:Describe*",
"events:Describe*",
"events:List*",
"firehose:Describe*",
"firehose:List*",
"fis:Get*",
"fis:List*",
"fsx:Describe*",
"fsx:List*",
"globalaccelerator:Describe*",
"globalaccelerator:List*",
"iam:GetInstanceProfile",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfiles",
"iam:ListRolePolicies",
"iam:ListRoles",
"iam:ListRoleTags",
"kafka:Describe*",
"kafka:GetClusterPolicy",
"kafka:List*",
"kafkaconnect:Describe*",
"kafkaconnect:List*",
"kinesis:Describe*",
"kinesis:List*",
"lambda:GetAlias",
"lambda:GetCodeSigningConfig",
"lambda:GetEventSourceMapping",
"lambda:GetFunctionCodeSigningConfig",
"lambda:GetFunctionConfiguration",
"lambda:GetFunctionEventInvokeConfig",
"lambda:GetFunctionRecursionConfig",
"lambda:GetFunctionUrlConfig",
"lambda:GetLayerVersion",
"lambda:GetLayerVersionPolicy",
"lambda:GetPolicy",
"lambda:GetProvisionedConcurrencyConfig",
"lambda:GetRuntimeManagementConfig",
"lambda:List*",
"memorydb:Describe*",
"memorydb:List*",
"network-firewall:Describe*",
"network-firewall:List*",
"qldb:Describe*",
"qldb:List*",
"ram:Get*",
"ram:List*",
"rds:Describe*",
"rds:List*",
"redshift:Describe*",
"redshift:List*",
"resource-groups:Get*",
"resource-groups:List*",
"resource-groups:Search*",
"route53-recovery-cluster:Get*",
"route53-recovery-cluster:List*",
"route53-recovery-control-config:Describe*",
"route53-recovery-control-config:Get*",
"route53-recovery-control-config:List*",
"route53-recovery-readiness:Get*",
"route53-recovery-readiness:List*",
"route53:Get*",
"route53:List*",
"route53domains:Check*",
"route53domains:List*",
"route53resolver:Get*",
"route53resolver:List*",
"s3:ListBucket",
"secretsmanager:DescribeSecret",
"secretsmanager:ListSecrets",
"servicecatalog:GetApplication",
"servicecatalog:ListAssociatedResources",
"shield:Describe*",
"shield:Get*",
"shield:List*",
"sns:GetDataProtectionPolicy",
"sns:GetSubscriptionAttributes",
"sns:GetTopicAttributes",
"sns:List*",
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:List*",
"ssm:Describe*",
"ssm:GetDefaultPatchBaseline",
"ssm:GetDocument",
"ssm:GetMaintenanceWindow",
"ssm:GetParameters",
"ssm:GetPatchBaseline",
"ssm:GetResourcePolicies",
"ssm:List*",
"ssm-incidents:GetReplicationSet",
"ssm-incidents:GetResponsePlan",
"ssm-incidents:List*",
"states:Describe*",
"states:List*",
"tag:GetResources",
"vpc-lattice:Get*",
"vpc-lattice:List*",
"wafv2:Get*",
"wafv2:List*"
],
"Resource": "*"
},
{
"Sid": "AWSResilienceHubApiGatewayStatement",
"Effect": "Allow",
"Action": [
"apigateway:GET"
],
"Resource": [
"arn:aws:apigateway:*::/apis/*",
"arn:aws:apigateway:*::/restapis/*",
"arn:aws:apigateway:*::/usageplans",
"arn:aws:apigateway:*::/domainnames/*"
]
},
{
"Sid": "AWSResilienceHubS3AccessStatement",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketObjectLockConfiguration",
"s3:GetBucketPolicy",
"s3:GetBucketPolicyStatus",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetMultiRegionAccessPointRoutes",
"s3:GetReplicationConfiguration",
"s3:ListAllMyBuckets",
"s3:ListMultiRegionAccessPoints"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2026-06-17T22:57:15+00:00"
}
}Version History (1 recorded)
Raw historyv1new policy
122 actions added