AWSThinkboxAWSPortalAdminPolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:27 PM UTC
Version
v12
Total Versions
12
Created
Feb 12, 2026
Actions
134
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWSPortal*, arn:aws:iam::*:role/DeadlineSpot*
- cloudformation:CreateStack: on arn:aws:cloudformation:*:*:stack/stack*/*, arn:aws:cloudformation:*:*:stack/Deadline*/*
- cloudformation:CreateChangeSet: on arn:aws:cloudformation:*:*:stack/stack*/*, arn:aws:cloudformation:*:*:stack/Deadline*/*
- cloudformation:ExecuteChangeSet: on arn:aws:cloudformation:*:*:stack/stack*/*, arn:aws:cloudformation:*:*:stack/Deadline*/*
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWSPortal*, arn:aws:iam::*:role/DeadlineSpot*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSThinkboxAWSPortal1",
"Effect": "Allow",
"Action": [
"ec2:AttachInternetGateway",
"ec2:AssociateAddress",
"ec2:AssociateRouteTable",
"ec2:AllocateAddress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateFleet",
"ec2:CreateLaunchTemplate",
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreatePlacementGroup",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeAddresses",
"ec2:DescribeFleets",
"ec2:DescribeFleetHistory",
"ec2:DescribeFleetInstances",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeRouteTables",
"ec2:DescribeNatGateways",
"ec2:DescribeTags",
"ec2:DescribeKeyPairs",
"ec2:DescribePlacementGroups",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeRegions",
"ec2:DescribeSpotFleetRequestHistory",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSpotFleetInstances",
"ec2:DescribeSpotFleetRequests",
"ec2:DescribeSpotPriceHistory",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeVpcEndpoints",
"ec2:GetConsoleOutput",
"ec2:ImportKeyPair",
"ec2:ReleaseAddress",
"ec2:RequestSpotFleet",
"ec2:CancelSpotFleetRequests",
"ec2:DisassociateAddress",
"ec2:DeleteFleets",
"ec2:DeleteLaunchTemplate",
"ec2:DeleteVpc",
"ec2:DeletePlacementGroup",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteInternetGateway",
"ec2:DeleteSecurityGroup",
"ec2:RevokeSecurityGroupIngress",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DisassociateRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteNatGateway",
"ec2:DetachInternetGateway",
"ec2:ModifyInstanceAttribute",
"ec2:ModifyFleet",
"ec2:ModifySpotFleetRequest",
"ec2:ModifyVpcAttribute"
],
"Resource": "*"
},
{
"Sid": "AWSThinkboxAWSPortal2",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:key-pair/*",
"arn:aws:ec2:*::snapshot/*",
"arn:aws:ec2:*:*:launch-template/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:placement-group/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*::image/*"
]
},
{
"Sid": "AWSThinkboxAWSPortal3",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"ArnLike": {
"ec2:InstanceProfile": "arn:aws:iam::*:instance-profile/AWSPortal*"
}
}
},
{
"Sid": "AWSThinkboxAWSPortal4",
"Effect": "Allow",
"Action": "ec2:TerminateInstances",
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/aws:cloudformation:logical-id": "ReverseForwarder"
}
}
},
{
"Sid": "AWSThinkboxAWSPortal5",
"Effect": "Allow",
"Action": "ec2:TerminateInstances",
"Resource": "*",
"Condition": {
"Null": {
"ec2:ResourceTag/aws:ec2spot:fleet-request-id": false
}
}
},
{
"Sid": "AWSThinkboxAWSPortal6",
"Effect": "Allow",
"Action": "ec2:TerminateInstances",
"Resource": "*",
"Condition": {
"ArnLike": {
"ec2:PlacementGroup": "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*"
}
}
},
{
"Sid": "AWSThinkboxAWSPortal7",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"ArnLike": {
"ec2:PlacementGroup": "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*"
}
}
},
{
"Sid": "AWSThinkboxAWSPortal8",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:CreateAction": "RunInstances"
}
}
},
{
"Sid": "AWSThinkboxAWSPortal9",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:natgateway/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:vpc-endpoint/*"
]
},
{
"Sid": "AWSThinkboxAWSPortal10",
"Effect": "Allow",
"Action": [
"iam:GetUser"
],
"Resource": "*"
},
{
"Sid": "AWSThinkboxAWSPortal11",
"Effect": "Allow",
"Action": [
"iam:GetInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:instance-profile/AWSPortal*"
]
},
{
"Sid": "AWSThinkboxAWSPortal12",
"Effect": "Allow",
"Action": [
"iam:GetPolicy",
"iam:ListEntitiesForPolicy",
"iam:ListPolicyVersions"
],
"Resource": [
"arn:aws:iam::*:policy/AWSPortal*"
]
},
{
"Sid": "AWSThinkboxAWSPortal13",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:GetRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/AWSPortal*",
"arn:aws:iam::*:role/DeadlineSpot*"
]
},
{
"Sid": "AWSThinkboxAWSPortal14",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/AWSPortal*",
"arn:aws:iam::*:role/DeadlineSpot*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"ec2.amazonaws.com",
"ec2fleet.amazonaws.com",
"spot.amazonaws.com",
"spotfleet.amazonaws.com",
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AWSThinkboxAWSPortal15",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"ec2fleet.amazonaws.com",
"spot.amazonaws.com",
"spotfleet.amazonaws.com"
]
}
}
},
{
"Sid": "AWSThinkboxAWSPortal16",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketVersioning",
"s3:PutBucketAcl",
"s3:PutBucketCORS",
"s3:PutBucketVersioning",
"s3:GetBucketAcl",
"s3:GetObject",
"s3:PutBucketLogging",
"s3:PutBucketTagging",
"s3:PutObject",
"s3:ListBucket",
"s3:ListBucketVersions",
"s3:PutEncryptionConfiguration",
"s3:PutLifecycleConfiguration",
"s3:DeleteBucket",
"s3:DeleteObject",
"s3:DeleteBucketPolicy",
"s3:DeleteObjectVersion"
],
"Resource": [
"arn:aws:s3::*:awsportal*",
"arn:aws:s3::*:stack*",
"arn:aws:s3::*:aws-portal-cache*",
"arn:aws:s3::*:logs-for-aws-portal-cache*",
"arn:aws:s3::*:logs-for-stack*"
]
},
{
"Sid": "AWSThinkboxAWSPortal17",
"Effect": "Allow",
"Action": [
"s3:PutBucketPolicy"
],
"Resource": [
"arn:aws:s3::*:logs-for-aws-portal-cache*"
]
},
{
"Sid": "AWSThinkboxAWSPortal18",
"Effect": "Allow",
"Action": [
"s3:PutBucketOwnershipControls"
],
"Resource": [
"arn:aws:s3::*:logs-for-stack*"
]
},
{
"Sid": "AWSThinkboxAWSPortal19",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Sid": "AWSThinkboxAWSPortal20",
"Effect": "Allow",
"Action": [
"dynamodb:Scan"
],
"Resource": "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*"
},
{
"Sid": "AWSThinkboxAWSPortal21",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:DeleteStack",
"cloudformation:DeleteChangeSet",
"cloudformation:ListStackResources",
"cloudformation:CreateChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:UpdateTerminationProtection",
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/stack*/*",
"arn:aws:cloudformation:*:*:stack/Deadline*/*"
]
},
{
"Sid": "AWSThinkboxAWSPortal22",
"Effect": "Allow",
"Action": [
"cloudformation:EstimateTemplateCost",
"cloudformation:DescribeStacks",
"cloudformation:ListStacks"
],
"Resource": "*"
},
{
"Sid": "AWSThinkboxAWSPortal23",
"Effect": "Allow",
"Action": [
"logs:DescribeLogStreams",
"logs:GetLogEvents",
"logs:PutRetentionPolicy",
"logs:DeleteRetentionPolicy"
],
"Resource": "arn:aws:logs:*:*:log-group:/thinkbox*"
},
{
"Sid": "AWSThinkboxAWSPortal24",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:CreateLogGroup"
],
"Resource": "*"
},
{
"Sid": "AWSThinkboxAWSPortal25",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:GenerateDataKey"
],
"Resource": [
"*"
],
"Condition": {
"StringLike": {
"kms:ViaService": [
"s3.*.amazonaws.com",
"secretsmanager.*.amazonaws.com"
]
}
}
},
{
"Sid": "AWSThinkboxAWSPortal26",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret"
],
"Resource": "*",
"Condition": {
"StringLike": {
"secretsmanager:Name": [
"rcs-tls-pw*"
]
}
}
},
{
"Sid": "AWSThinkboxAWSPortal27",
"Effect": "Allow",
"Action": [
"secretsmanager:DeleteSecret",
"secretsmanager:UpdateSecret",
"secretsmanager:DescribeSecret",
"secretsmanager:TagResource"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*"
}
]
},
"VersionId": "v12",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T17:57:40+00:00"
}
}Version History (17 recorded)
Raw historyAWSThinkboxAWSPortalAdminPolicy - Policy Version v12
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
a690770AWSThinkboxAWSPortalAdminPolicy - Policy Version v12
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
e683dcdAWSThinkboxAWSPortalAdminPolicy - Policy Version v11
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
6fa6281AWSThinkboxAWSPortalAdminPolicy - Policy Version v10
No recorded action delta - this version predates the change index. View the raw diff.
Jan 15, 2026
fe4f56fAWSThinkboxAWSPortalAdminPolicy - Policy Version v9
No recorded action delta - this version predates the change index. View the raw diff.
Jan 14, 2026
9944792Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 12, 2024
65c1b5eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 12, 2024
11d556cUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 12, 2024
f3c6e09Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 24, 2024
3e4f860Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 18, 2023
0c86830Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 23, 2023
bafa054Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 20, 2020
c32b5b2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 19, 2020
d0fb12dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 8, 2020
2600b26Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 27, 2020
d977067