AWSTransformInfrastructureExecutorAccessBatch
Last Modified
Sep 2, 2026
September 2, 2026 at 10:03 PM UTC
Version
v3
Total Versions
3
Created
Sep 2, 2026
Actions
44
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/AtxSchedulerInvocationRole, arn:aws:iam::*:role/AtxSchedulerInvocationRole-*
- scheduler:CreateSchedule: condition aws:ResourceAccount, on arn:aws:scheduler:*:*:schedule-group/atx-ct, arn:aws:scheduler:*:*:schedule-group/atx-ct-*, arn:aws:scheduler:*:*:schedule/atx-ct/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (4)
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::atx-source-code-*/* to remove the redundancy. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::atx-custom-output-*/* to remove the redundancy. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::atx-ct-output-*/* to remove the redundancy. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:cloudformation:*:*:stack/atx-*/* to remove the redundancy. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "LambdaInvokeATXFunctions",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:GetFunctionConfiguration"
],
"Resource": [
"arn:aws:lambda:*:*:function:atx-trigger-job-*",
"arn:aws:lambda:*:*:function:atx-trigger-batch-jobs-*",
"arn:aws:lambda:*:*:function:atx-get-job-status-*",
"arn:aws:lambda:*:*:function:atx-get-batch-status-*",
"arn:aws:lambda:*:*:function:atx-list-jobs-*",
"arn:aws:lambda:*:*:function:atx-list-batches-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3UploadSourceCode",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:ListBucket",
"s3:AbortMultipartUpload"
],
"Resource": [
"arn:aws:s3:::atx-source-code-*",
"arn:aws:s3:::atx-source-code-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3DownloadResults",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::atx-custom-output-*",
"arn:aws:s3:::atx-custom-output-*/*",
"arn:aws:s3:::atx-ct-output-*",
"arn:aws:s3:::atx-ct-output-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3WriteBatchSidecar",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:AbortMultipartUpload"
],
"Resource": [
"arn:aws:s3:::atx-custom-output-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KMSEncryptDecrypt",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"ForAnyValue:StringLike": {
"kms:ResourceAliases": [
"alias/atx-encryption-key",
"alias/atx-encryption-key-*"
]
}
}
},
{
"Sid": "CloudWatchReadLogs",
"Effect": "Allow",
"Action": [
"logs:GetLogEvents",
"logs:FilterLogEvents",
"logs:DescribeLogStreams"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/batch/atx-transform*",
"arn:aws:logs:*:*:log-group:/aws/batch/job*",
"arn:aws:logs:*:*:log-group:AtxVpc*",
"arn:aws:logs:*:*:log-group:/aws/lambda/atx-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CloudWatchDashboard",
"Effect": "Allow",
"Action": [
"cloudwatch:GetDashboard",
"cloudwatch:ListDashboards"
],
"Resource": [
"arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard",
"arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "BatchDescribe",
"Effect": "Allow",
"Action": [
"batch:DescribeComputeEnvironments",
"batch:DescribeJobQueues",
"batch:DescribeJobDefinitions",
"batch:DescribeJobs",
"batch:ListJobs"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CheckInfrastructureStatus",
"Effect": "Allow",
"Action": "cloudformation:DescribeStacks",
"Resource": [
"arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack/*",
"arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack-*/*",
"arn:aws:cloudformation:*:*:stack/atx-*",
"arn:aws:cloudformation:*:*:stack/atx-*/*",
"arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*",
"arn:aws:cloudformation:*:*:stack/AtxDispatcherStack/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SecretsManagerATXSecrets",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:atx/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SchedulerManage",
"Effect": "Allow",
"Action": [
"scheduler:CreateSchedule",
"scheduler:DeleteSchedule",
"scheduler:GetSchedule",
"scheduler:UpdateSchedule",
"scheduler:GetScheduleGroup",
"scheduler:ListSchedules"
],
"Resource": [
"arn:aws:scheduler:*:*:schedule-group/atx-ct",
"arn:aws:scheduler:*:*:schedule-group/atx-ct-*",
"arn:aws:scheduler:*:*:schedule/atx-ct/*",
"arn:aws:scheduler:*:*:schedule/atx-ct-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "PassSchedulerRole",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/AtxSchedulerInvocationRole",
"arn:aws:iam::*:role/AtxSchedulerInvocationRole-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "scheduler.amazonaws.com",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkDiscovery",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeRouteTables",
"ec2:DescribeNatGateways"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IAMReadRoles",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:GetRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/ATX*",
"arn:aws:iam::*:role/Atx*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "TagGetATXStacks",
"Effect": "Allow",
"Action": "tag:GetResources",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CFNListStacksForDetect",
"Effect": "Allow",
"Action": "cloudformation:ListStacks",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SQSEnqueueToDispatcher",
"Effect": "Allow",
"Action": "sqs:SendMessage",
"Resource": "arn:aws:sqs:*:*:atx-dispatcher-queue",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-09-02T21:27:07+00:00"
}
}Version History (3 recorded)
Raw historyv3updated
1 action added
v2updated
scope changed, no action added or removed
v1new policy
39 actions added
Permissions management: iam:PassRole: iam:PassRole