AWSServiceRoleForImageBuilder
Last Modified
Oct 28, 2026
October 28, 2026 at 12:03 AM UTC
Version
v29
Total Versions
28
Created
Oct 27, 2026
Actions
85
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can take over existing resources that run as another role
Grants every action of 2 documented escalation paths on any resource with no condition, and 1 more in a scoped form.
- ssm:SendCommand: on arn:aws:ssm:*:*:document/AWS-RunPowerShellScript, arn:aws:ssm:*:*:document/AWS-RunShellScript, arn:aws:ssm:*:*:document/AWSEC2-RunSysprep
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
- Medium
Can take over other users or roles
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- sts:AssumeRole: on arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:RegisterImage",
"Resource": [
"arn:aws:ec2:*::image/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RegisterImage",
"Resource": [
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:key-pair/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:license-manager:*:*:license-configuration:*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": [
"EC2 Image Builder",
"EC2 Fast Launch"
]
}
}
},
{
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com",
"ec2.amazonaws.com.cn",
"vmie.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:StopInstances",
"ec2:StartInstances",
"ec2:TerminateInstances"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CopyImage",
"ec2:CreateImage",
"ec2:CreateLaunchTemplate",
"ec2:DeregisterImage",
"ec2:DescribeImages",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:ModifyImageAttribute",
"ec2:DescribeImportImageTasks",
"ec2:DescribeExportImageTasks",
"ec2:DescribeSnapshots",
"ec2:DescribeHosts"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:ModifySnapshotAttribute"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": [
"RunInstances",
"CreateImage"
],
"aws:RequestTag/CreatedBy": [
"EC2 Image Builder",
"EC2 Fast Launch"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*:*:export-image-task/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:launch-template/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": [
"EC2 Image Builder",
"EC2 Fast Launch"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"license-manager:UpdateLicenseSpecificationsForResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sns:Publish"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:ListCommands",
"ssm:ListCommandInvocations",
"ssm:AddTagsToResource",
"ssm:DescribeInstanceInformation",
"ssm:GetAutomationExecution",
"ssm:StopAutomationExecution",
"ssm:ListInventoryEntries",
"ssm:SendAutomationSignal",
"ssm:DescribeInstanceAssociationsStatus",
"ssm:DescribeAssociationExecutions",
"ssm:GetCommandInvocation"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": [
"arn:aws:ssm:*:*:document/AWS-RunPowerShellScript",
"arn:aws:ssm:*:*:document/AWS-RunShellScript",
"arn:aws:ssm:*:*:document/AWSEC2-RunSysprep",
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringEquals": {
"ssm:resourceTag/CreatedBy": [
"EC2 Image Builder"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:DeleteAssociation"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory",
"arn:aws:ssm:*:*:association/*",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncryptFrom",
"kms:ReEncryptTo",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"kms:EncryptionContextKeys": [
"aws:ebs:id"
]
},
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
},
"StringLike": {
"kms:ViaService": [
"ec2.*.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::*:role/EC2ImageBuilderDistributionCrossAccountRole"
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateLaunchTemplateVersion",
"ec2:DescribeLaunchTemplates",
"ec2:ModifyLaunchTemplate",
"ec2:DescribeLaunchTemplateVersions"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:ExportImage"
],
"Resource": "arn:aws:ec2:*::image/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:ExportImage"
],
"Resource": "arn:aws:ec2:*:*:export-image-task/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CancelExportTask"
],
"Resource": "arn:aws:ec2:*:*:export-image-task/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"agentless.inspector2.amazonaws.com",
"ami.inspector2.amazonaws.com",
"ec2fastlaunch.amazonaws.com",
"inspector2.amazonaws.com",
"ssm.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:EnableFastLaunch"
],
"Resource": [
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*:*:launch-template/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:AttachImageWatermark"
],
"Resource": "arn:aws:ec2:*::image/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"inspector2:ListCoverage",
"inspector2:ListFindings"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"inspector2:StartOnDemandScan",
"inspector2:GetOnDemandScanStatus",
"inspector2:ListOnDemandScans"
],
"Resource": [
"arn:aws:inspector2:*:*:*"
]
},
{
"Effect": "Allow",
"Action": [
"ecr:CreateRepository"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ecr:TagResource"
],
"Resource": "arn:aws:ecr:*:*:repository/image-builder-*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"ecr:BatchDeleteImage"
],
"Resource": "arn:aws:ecr:*:*:repository/image-builder-*",
"Condition": {
"StringEquals": {
"ecr:ResourceTag/CreatedBy": "EC2 Image Builder"
}
}
},
{
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:DescribeRule",
"events:PutRule",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource": [
"arn:aws:events:*:*:rule/ImageBuilder-*"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:PutParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/imagebuilder/*"
},
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter"
],
"Resource": "arn:aws:ssm:*::parameter/aws/service/*"
},
{
"Effect": "Allow",
"Action": "imagebuilder:StartImagePipelineExecution",
"Resource": "arn:aws:imagebuilder:*:*:image-pipeline/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Effect": "Allow",
"Action": "imagebuilder:TagResource",
"Resource": "arn:aws:imagebuilder:*:*:image-pipeline/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v29",
"IsDefaultVersion": true,
"CreateDate": "2026-10-27T23:37:07+00:00"
}
}Version History (33 recorded)
Raw history3 actions added
1 action added
2 actions added
AWSServiceRoleForImageBuilder - Policy Version v26
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
996e2d8AWSServiceRoleForImageBuilder - Policy Version v26
No recorded action delta - this version predates the change index. View the raw diff.
Feb 24, 2026
9549f9bAWSServiceRoleForImageBuilder - Policy Version v25
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
928e317AWSServiceRoleForImageBuilder - Policy Version v23
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
744ee09AWSServiceRoleForImageBuilder - Policy Version v21
No recorded action delta - this version predates the change index. View the raw diff.
Jul 23, 2025
b61b1a3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 27, 2024
9e0d428Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 19, 2023
a247175Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 13, 2023
2f459d0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 16, 2022
6f028b3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 16, 2022
8208687Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 17, 2022
203999bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 17, 2022
a50bd33Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 16, 2022
cb7f843Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 16, 2022
774a7d5Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 6, 2021
22afed9