AWSSSMForSAPServiceLinkedRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v21
Total Versions
13
Created
Feb 12, 2026
Actions
55
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- ssm:SendCommand: on arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*, arn:*:ssm:*:*:document/AWSSSMSAP*, arn:*:ssm:*:*:document/AWSSAP*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (1)
- Warning / TYPE_MISMATCH
Use the operator type String, Numeric instead of operator ARN for the condition key aws:RequestTag/awsApplication. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DescribeInstanceActions",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeRouteTables",
"ec2:DescribeInstanceTypes",
"ec2:DescribeVolumes",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeVpcs",
"ssm:GetCommandInvocation",
"ssm:DescribeInstanceInformation"
],
"Resource": "*"
},
{
"Sid": "DescribeInstanceStatus",
"Effect": "Allow",
"Action": "ec2:DescribeInstanceStatus",
"Resource": "*"
},
{
"Sid": "TargetRuleActions",
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:PutTargets",
"events:DescribeRule",
"events:PutRule",
"events:RemoveTargets"
],
"Resource": [
"arn:*:events:*:*:rule/SSMSAPManagedRule*",
"arn:*:events:*:*:event-bus/default"
]
},
{
"Sid": "DocumentActions",
"Effect": "Allow",
"Action": [
"ssm:DescribeDocument",
"ssm:SendCommand"
],
"Resource": [
"arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*",
"arn:*:ssm:*:*:document/AWSSSMSAP*",
"arn:*:ssm:*:*:document/AWSSAP*"
]
},
{
"Sid": "CustomerSendCommand",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": "arn:*:ec2:*:*:instance/*",
"Condition": {
"StringEqualsIgnoreCase": {
"ssm:resourceTag/SSMForSAPManaged": "True"
}
}
},
{
"Sid": "InstanceTagActions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:*:ec2:*:*:instance/*",
"Condition": {
"Null": {
"aws:RequestTag/awsApplication": "false"
},
"StringEqualsIgnoreCase": {
"ec2:ResourceTag/SSMForSAPManaged": "True"
}
}
},
{
"Sid": "DescribeTag",
"Effect": "Allow",
"Action": "ec2:DescribeTags",
"Resource": "*"
},
{
"Sid": "GetApplication",
"Effect": "Allow",
"Action": "servicecatalog:GetApplication",
"Resource": "arn:*:servicecatalog:*:*:*"
},
{
"Sid": "UpdateOrDeleteApplication",
"Effect": "Allow",
"Action": [
"servicecatalog:DeleteApplication",
"servicecatalog:UpdateApplication"
],
"Resource": "arn:*:servicecatalog:*:*:*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "CreateApplication",
"Effect": "Allow",
"Action": [
"servicecatalog:TagResource",
"servicecatalog:CreateApplication"
],
"Resource": "arn:*:servicecatalog:*:*:*",
"Condition": {
"StringEquals": {
"aws:RequestTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "CreateServiceLinkedRole",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": "servicecatalog-appregistry.amazonaws.com"
}
}
},
{
"Sid": "PutMetricData",
"Effect": "Allow",
"Action": "cloudwatch:PutMetricData",
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": [
"AWS/Usage",
"AWS/SSMForSAP"
]
}
}
},
{
"Sid": "CreateAttributeGroup",
"Effect": "Allow",
"Action": "servicecatalog:CreateAttributeGroup",
"Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "GetAttributeGroup",
"Effect": "Allow",
"Action": "servicecatalog:GetAttributeGroup",
"Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*"
},
{
"Sid": "DeleteAttributeGroup",
"Effect": "Allow",
"Action": "servicecatalog:DeleteAttributeGroup",
"Resource": "arn:*:servicecatalog:*:*:/attribute-groups/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "AttributeGroupActions",
"Effect": "Allow",
"Action": [
"servicecatalog:AssociateAttributeGroup",
"servicecatalog:DisassociateAttributeGroup"
],
"Resource": "arn:*:servicecatalog:*:*:*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "ListAssociatedAttributeGroups",
"Effect": "Allow",
"Action": "servicecatalog:ListAssociatedAttributeGroups",
"Resource": "arn:*:servicecatalog:*:*:*"
},
{
"Sid": "CreateGroup",
"Effect": "Allow",
"Action": [
"resource-groups:CreateGroup",
"resource-groups:Tag"
],
"Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPCreated": "True"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"SSMForSAPCreated"
]
}
}
},
{
"Sid": "GetGroup",
"Effect": "Allow",
"Action": "resource-groups:GetGroup",
"Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*"
},
{
"Sid": "DeleteGroup",
"Effect": "Allow",
"Action": "resource-groups:DeleteGroup",
"Resource": "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPCreated": "True"
}
}
},
{
"Sid": "CreateAppTagResourceGroup",
"Effect": "Allow",
"Action": [
"resource-groups:CreateGroup"
],
"Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*",
"Condition": {
"StringEquals": {
"aws:RequestTag/EnableAWSServiceCatalogAppRegistry": "true"
}
}
},
{
"Sid": "TagAppTagResourceGroup",
"Effect": "Allow",
"Action": [
"resource-groups:Tag"
],
"Resource": "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/EnableAWSServiceCatalogAppRegistry": "true"
}
}
},
{
"Sid": "GetAppTagResourceGroupConfig",
"Effect": "Allow",
"Action": [
"resource-groups:GetGroupConfiguration"
],
"Resource": [
"arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*"
]
},
{
"Sid": "StartStopInstances",
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "arn:*:ec2:*:*:instance/*",
"Condition": {
"StringEqualsIgnoreCase": {
"ec2:resourceTag/SSMForSAPManaged": "True"
}
}
},
{
"Sid": "SsmSapResourceGroup",
"Effect": "Allow",
"Action": [
"resource-groups:Tag",
"resource-groups:CreateGroup"
],
"Resource": "arn:aws:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition": {
"StringEquals": {
"aws:RequestTag/SSMForSAPCreated": "True"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"SSMForSAPCreated"
]
}
}
},
{
"Sid": "ManageSsmSapTagsOnEc2Instances",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/SSMForSAPManaged": "True"
},
"ForAllValues:StringLike": {
"aws:TagKeys": [
"SystemsManagerForSAP-*"
]
}
}
},
{
"Sid": "ManageSsmSapTagsOnEbsVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": [
"SystemsManagerForSAP-*"
]
}
}
},
{
"Sid": "ManageAppTagsOnEbsVolumes",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"ArnLike": {
"aws:RequestTag/awsApplication": "arn:aws:resource-groups:*:*:group/*/*"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"awsApplication"
]
}
}
},
{
"Sid": "ManageCostAllocationTags",
"Effect": "Allow",
"Action": [
"ce:ListCostAllocationTags",
"ce:UpdateCostAllocationTagsStatus",
"ce:ListCostAllocationTagBackfillHistory",
"ce:StartCostAllocationTagBackfill"
],
"Resource": "*"
}
]
},
"VersionId": "v21",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:03:20+00:00"
}
}Version History (18 recorded)
Raw historyAWSSSMForSAPServiceLinkedRolePolicy - Policy Version v21
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
568f6dbAWSSSMForSAPServiceLinkedRolePolicy - Policy Version v21
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
493f48bAWSSSMForSAPServiceLinkedRolePolicy - Policy Version v17
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
d1825b3AWSSSMForSAPServiceLinkedRolePolicy - Policy Version v13
No recorded action delta - this version predates the change index. View the raw diff.
Aug 13, 2025
3ddd6d1Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 9, 2025
8d05165Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 28, 2025
499e4e0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 11, 2024
f85d0edUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 30, 2024
187bab2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 6, 2024
631093fUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 11, 2024
dcf431dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 21, 2023
8ed8c30Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 17, 2023
f0e9693Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 1, 2023
b021270Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 31, 2023
95e80d4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 6, 2023
af7e692Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 16, 2022
f846b03