AWSThinkboxDeadlineSpotEventPluginAdminPolicy

Last Modified

Mar 12, 2026

March 12, 2026 at 09:27 PM UTC

Version

v1

Total Versions

1

Created

May 27, 2020

Actions

13

Subscribe to updates

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Medium

    Can launch resources that run as a more privileged role

    Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.

    • ec2-001iam:PassRole + ec2:RunInstancesscoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role, arn:aws:iam::*:role/DeadlineSpot*

    Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.

IAM Access Analyzer (1)

  • Suggestion / EQUIVALENT_TO_NULL_FALSE

    We recommend replacing the key ec2:ResourceTag/aws:ec2spot:fleet-request-id in the condition block of StringLike with {ec2:ResourceTag/aws:ec2spot:fleet-request-id: false} to ensure better enforcement of the condition. AWS docs

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CancelSpotFleetRequests",
            "ec2:DescribeSpotFleetInstances",
            "ec2:DescribeSpotFleetRequests",
            "ec2:ModifySpotFleetRequest",
            "ec2:RequestSpotFleet"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CreateTags"
          ],
          "Resource": [
            "arn:aws:ec2:*:*:instance/*"
          ],
          "Condition": {
            "StringEquals": {
              "ec2:CreateAction": "RunInstances"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:RunInstances"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:TerminateInstances"
          ],
          "Resource": [
            "arn:aws:ec2:*:*:instance/*"
          ],
          "Condition": {
            "StringLike": {
              "ec2:ResourceTag/aws:ec2spot:fleet-request-id": "*"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:CreateServiceLinkedRole"
          ],
          "Resource": [
            "arn:aws:iam::*:role/aws-service-role/*"
          ],
          "Condition": {
            "StringEquals": {
              "iam:AWSServiceName": [
                "spot.amazonaws.com",
                "spotfleet.amazonaws.com"
              ]
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:GetInstanceProfile"
          ],
          "Resource": [
            "arn:aws:iam::*:instance-profile/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:GetRole"
          ],
          "Resource": [
            "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role",
            "arn:aws:iam::*:role/DeadlineSpot*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:GetUser"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Resource": [
            "arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role",
            "arn:aws:iam::*:role/DeadlineSpot*"
          ],
          "Condition": {
            "StringLike": {
              "iam:PassedToService": "ec2.amazonaws.com"
            }
          }
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2020-05-27T19:38:34+00:00"
  }
}

Version History (4 recorded)

Raw history

AWSThinkboxDeadlineSpotEventPluginAdminPolicy - Policy Version v1

No recorded action delta - this version predates the change index. View the raw diff.

Mar 12, 2026

71b32cb

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Sep 18, 2024

aafbae9

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

May 13, 2024

1b36617

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

May 27, 2020

d977067