Deprecated

Removed from AWS on 2021-04-02 - Active for 10 months

AWSServiceRoleForThorInternalDevPolicy

Last Modified

Jun 18, 2020

June 18, 2020 at 08:48 PM UTC

Version

v1

Total Versions

1

Created

Jun 18, 2020

Actions

8

Subscribe to updates

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • High

    Can change identities and their permissions

    Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.

    sso:associateprofile

    Use with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
            "sso:GetManagedApplicationInstance",
            "sso:GetProfile",
            "sso:ListProfiles",
            "sso:ListProfileAssociations",
            "sso:AssociateProfile",
            "sso:ListDirectoryAssociations",
            "sso-directory:DescribeUsers",
            "sso-directory:SearchUsers"
          ],
          "Resource": "*",
          "Effect": "Allow"
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2020-06-18T18:42:19Z"
  }
}

Version History (1 recorded)

Raw history

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jun 18, 2020

3940130