AWSTransformApplicationDeploymentPolicy

Last Modified

Sep 11, 2026

September 11, 2026 at 01:03 AM UTC

Version

v10

Total Versions

4

Created

Sep 11, 2026

Actions

47

Subscribe to updates

Risk

Medium

The same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • Medium

    Can launch resources that run as a more privileged role

    Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.

    • cloudformation-001iam:PassRole + cloudformation:CreateStackscoped
      • iam:PassRole: condition aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/AWSTransform-Deploy-Builder-Instance-Role, arn:aws:iam::*:role/AWSTransform-Deploy-App-Instance-Role
      • cloudformation:CreateStack: condition aws:RequestTag/CreatedBy, aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/AWSTransform*
    • ec2-001iam:PassRole + ec2:RunInstancesscoped
      • iam:PassRole: condition aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/AWSTransform-Deploy-Builder-Instance-Role, arn:aws:iam::*:role/AWSTransform-Deploy-App-Instance-Role
      • ec2:RunInstances: condition aws:CalledVia, on arn:aws:ec2:*::image/*

    Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.

  • Medium

    Can take over existing resources that run as another role

    Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.

    • cloudformation-002cloudformation:UpdateStackscoped
      • cloudformation:UpdateStack: condition aws:RequestTag/CreatedBy, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:cloudformation:*:*:stack/AWSTransform*
    • ec2-002ec2:ModifyInstanceAttribute + ec2:StopInstances + ec2:StartInstancesscoped
      • ec2:ModifyInstanceAttribute: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*
      • ec2:StopInstances: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*
      • ec2:StartInstances: condition aws:CalledVia, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:ec2:*:*:instance/*
    • ssm-002ssm:SendCommandscoped
      • ssm:SendCommand: on arn:aws:ssm:*:*:document/AWS-RunRemoteScript

    Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.

IAM Access Analyzer (4)

  • Suggestion / REDUNDANT_RESOURCE

    The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::aws-transform-deployment-bucket-*/* to remove the redundancy. AWS docs

  • Suggestion / EQUIVALENT_TO_NULL_FALSE

    We recommend replacing the key kms:EncryptionContext:aws-transform in the condition block of StringLike with {kms:EncryptionContext:aws-transform: false} to ensure better enforcement of the condition. AWS docs

  • Suggestion / EQUIVALENT_TO_NULL_FALSE

    We recommend replacing the key kms:EncryptionContext:aws:ebs:id in the condition block of StringLike with {kms:EncryptionContext:aws:ebs:id: false} to ensure better enforcement of the condition. AWS docs

  • Suggestion / EQUIVALENT_TO_NULL_FALSE

    We recommend replacing the key kms:EncryptionContext:aws:ebs:id in the condition block of StringLike with {kms:EncryptionContext:aws:ebs:id: false} to ensure better enforcement of the condition. AWS docs

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "cloudformation:DescribeStacks",
            "cloudformation:DescribeStackEvents"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": [
            "arn:aws:cloudformation:*:*:stack/AWSTransform*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "cloudformation:CreateStack"
          ],
          "Condition": {
            "StringEquals": {
              "aws:RequestTag/CreatedBy": "AWSTransform",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": "arn:aws:cloudformation:*:*:stack/AWSTransform*"
        },
        {
          "Sid": "CloudFormationTagOnCreate",
          "Effect": "Allow",
          "Action": [
            "cloudformation:TagResource",
            "cloudformation:UntagResource"
          ],
          "Resource": "arn:aws:cloudformation:*:*:stack/AWSTransform*",
          "Condition": {
            "StringEquals": {
              "cloudformation:CreateAction": [
                "CreateStack",
                "UpdateStack"
              ]
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "cloudformation:DeleteStack"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/CreatedBy": "AWSTransform",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": "arn:aws:cloudformation:*:*:stack/AWSTransform*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "cloudformation:UpdateStack"
          ],
          "Condition": {
            "StringEquals": {
              "aws:RequestTag/CreatedBy": "AWSTransform",
              "aws:ResourceTag/CreatedBy": "AWSTransform",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": "arn:aws:cloudformation:*:*:stack/AWSTransform*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeImages",
            "ec2:DescribeInstances",
            "ec2:DescribeRouteTables",
            "ec2:DescribeInternetGateways"
          ],
          "Resource": "*"
        },
        {
          "Effect": "Deny",
          "Action": [
            "ec2:CreateTags",
            "ec2:DeleteTags"
          ],
          "Resource": "arn:aws:ec2:*:*:instance/*",
          "Condition": {
            "ForAnyValue:StringNotEquals": {
              "aws:TagKeys": [
                "Name",
                "CreatedBy",
                "ApplicationName",
                "TransformationType",
                "aws:cloudformation:stack-name",
                "aws:cloudformation:logical-id",
                "aws:cloudformation:stack-id"
              ]
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:CreateTags",
            "ec2:DeleteTags"
          ],
          "Condition": {
            "ForAnyValue:StringEquals": {
              "aws:CalledVia": "cloudformation.amazonaws.com"
            },
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:RunInstances"
          ],
          "Condition": {
            "ForAnyValue:StringEquals": {
              "aws:CalledVia": "cloudformation.amazonaws.com"
            }
          },
          "Resource": [
            "arn:aws:ec2:*::image/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:RunInstances"
          ],
          "Condition": {
            "ForAnyValue:StringEquals": {
              "aws:CalledVia": "cloudformation.amazonaws.com"
            },
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": [
            "arn:aws:ec2:*:*:subnet/*",
            "arn:aws:ec2:*:*:security-group/*",
            "arn:aws:ec2:*:*:network-interface/*",
            "arn:aws:ec2:*:*:instance/*",
            "arn:aws:ec2:*:*:volume/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:GetRole",
            "iam:GetInstanceProfile",
            "iam:GetRolePolicy",
            "iam:ListRolePolicies",
            "iam:ListAttachedRolePolicies"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": [
            "arn:aws:iam::*:role/AWSTransform-Deploy-Builder-Instance-Role",
            "arn:aws:iam::*:instance-profile/AWSTransform-Deploy-Builder-Instance-Role",
            "arn:aws:iam::*:role/AWSTransform-Deploy-App-Instance-Role",
            "arn:aws:iam::*:instance-profile/AWSTransform-Deploy-App-Instance-Role"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Condition": {
            "StringEquals": {
              "iam:PassedToService": "ec2.amazonaws.com",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          },
          "Resource": [
            "arn:aws:iam::*:role/AWSTransform-Deploy-Builder-Instance-Role",
            "arn:aws:iam::*:role/AWSTransform-Deploy-App-Instance-Role"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ssm:GetParameters"
          ],
          "Resource": "arn:aws:ssm:*::parameter/aws/service/ami-amazon-linux-latest*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ec2:TerminateInstances",
            "ec2:StopInstances",
            "ec2:StartInstances",
            "ec2:ModifyInstanceAttribute"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/CreatedBy": "AWSTransform",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            },
            "ForAnyValue:StringEquals": {
              "aws:CalledVia": "cloudformation.amazonaws.com"
            }
          },
          "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "ssm:SendCommand"
          ],
          "Resource": [
            "arn:aws:ssm:*:*:document/AWS-RunRemoteScript"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "ssm:SendCommand"
          ],
          "Resource": "arn:aws:ec2:*:*:instance/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/CreatedBy": "AWSTransform"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "ssm:DescribeInstanceInformation",
            "ssm:GetCommandInvocation"
          ],
          "Resource": [
            "arn:aws:ssm:*:*:*",
            "arn:aws:ec2:*:*:instance/*"
          ]
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:GetBucketLocation",
            "s3:PutObject",
            "s3:ListMultipartUploadParts",
            "s3:ListBucketMultipartUploads",
            "s3:AbortMultipartUpload",
            "s3:PutBucketTagging"
          ],
          "Resource": [
            "arn:aws:s3:::aws-transform-deployment-bucket-*",
            "arn:aws:s3:::aws-transform-deployment-bucket-*/*"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:ListAllMyBuckets"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "kms:Decrypt",
            "kms:GenerateDataKey"
          ],
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/CreatedFor": "AWSTransform",
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            },
            "StringLike": {
              "kms:EncryptionContext:aws-transform": "*",
              "kms:ViaService": "s3.*.amazonaws.com"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "kms:CreateGrant"
          ],
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "Bool": {
              "kms:GrantIsForAWSResource": "true"
            },
            "StringLike": {
              "kms:ViaService": [
                "ec2.*.amazonaws.com"
              ],
              "kms:EncryptionContext:aws:ebs:id": "*"
            },
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}",
              "kms:GrantConstraintType": "EncryptionContextSubset"
            },
            "ForAllValues:StringEquals": {
              "kms:GrantOperations": [
                "Decrypt"
              ]
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "kms:GenerateDataKeyWithoutPlaintext"
          ],
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringLike": {
              "kms:ViaService": "ec2.*.amazonaws.com",
              "kms:EncryptionContext:aws:ebs:id": "*"
            }
          }
        },
        {
          "Effect": "Allow",
          "Action": [
            "kms:DescribeKey"
          ],
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        }
      ]
    },
    "VersionId": "v10",
    "IsDefaultVersion": true,
    "CreateDate": "2026-09-11T00:27:08+00:00"
  }
}

Version History (7 recorded)

Raw history
v10updated

2 actions added

380895e

AWSTransformApplicationDeploymentPolicy - Policy Version v9

No recorded action delta - this version predates the change index. View the raw diff.

Mar 12, 2026

95a6c10

AWSTransformApplicationDeploymentPolicy - Policy Version v9

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

49eb826

AWSTransformApplicationDeploymentPolicy - Policy Version v6

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

c285632

AWSTransformApplicationDeploymentPolicy - Policy Version v3

No recorded action delta - this version predates the change index. View the raw diff.

Nov 24, 2025

e1761f5

AWSTransformApplicationDeploymentPolicy - Policy Version v2

No recorded action delta - this version predates the change index. View the raw diff.

Sep 30, 2025

b39cbf3

AWSTransformApplicationDeploymentPolicy - Policy Version v1

No recorded action delta - this version predates the change index. View the raw diff.

Aug 28, 2025

ebf4cc3