AWSTransformInfrastructureExecutorAccessEC2
Last Modified
Sep 2, 2026
September 2, 2026 at 10:03 PM UTC
Version
v3
Total Versions
3
Created
Sep 2, 2026
Actions
51
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:ResourceAccount, iam:PassedToService, on arn:aws:iam::*:role/atx-transform-role, arn:aws:iam::*:role/atx-transform-role-*
- scheduler:CreateSchedule: condition aws:ResourceAccount, on arn:aws:scheduler:*:*:schedule/atx-ct/*, arn:aws:scheduler:*:*:schedule/atx-ct-*/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ssm:StartSession: condition ssm:resourceTag/atx-remote-infra, on arn:aws:ec2:*:*:instance/*
- ssm:SendCommand: condition ssm:resourceTag/atx-remote-infra, on arn:aws:ec2:*:*:instance/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (2)
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::atx-source-code-*/* to remove the redundancy. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::atx-ct-output-*/* to remove the redundancy. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CFNRead",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStackDriftDetectionStatus"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/atx-*/*",
"arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*",
"arn:aws:cloudformation:*:*:stack/AtxDispatcherStack/*"
]
},
{
"Sid": "CFNValidateTemplate",
"Effect": "Allow",
"Action": "cloudformation:ValidateTemplate",
"Resource": "*"
},
{
"Sid": "EC2Desc",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeImages",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeKeyPairs",
"ec2:DescribeRouteTables",
"ec2:DescribeNatGateways",
"ec2:DescribeInternetGateways"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2PowerState",
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/atx-remote-infra": "true"
}
}
},
{
"Sid": "SSMRead",
"Effect": "Allow",
"Action": [
"ssm:GetCommandInvocation",
"ssm:ListCommands",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation",
"ssm:DescribeSessions"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SSMTgt",
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringEquals": {
"ssm:resourceTag/atx-remote-infra": "true"
}
}
},
{
"Sid": "SSMDocs",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": "arn:aws:ssm:*::document/AWS-RunShellScript"
},
{
"Sid": "S3Data",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::atx-source-code-*",
"arn:aws:s3:::atx-source-code-*/*",
"arn:aws:s3:::atx-ct-output-*",
"arn:aws:s3:::atx-ct-output-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KMSEncryptDecrypt",
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"ForAnyValue:StringLike": {
"kms:ResourceAliases": [
"alias/atx-encryption-key",
"alias/atx-encryption-key-*"
]
}
}
},
{
"Sid": "SM",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:atx/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SMList",
"Effect": "Allow",
"Action": "secretsmanager:ListSecrets",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SchedLifecycle",
"Effect": "Allow",
"Action": [
"scheduler:CreateSchedule",
"scheduler:DeleteSchedule",
"scheduler:GetSchedule",
"scheduler:UpdateSchedule"
],
"Resource": [
"arn:aws:scheduler:*:*:schedule/atx-ct/*",
"arn:aws:scheduler:*:*:schedule/atx-ct-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SchedGroupRead",
"Effect": "Allow",
"Action": "scheduler:GetScheduleGroup",
"Resource": [
"arn:aws:scheduler:*:*:schedule-group/atx-ct",
"arn:aws:scheduler:*:*:schedule-group/atx-ct-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SchedList",
"Effect": "Allow",
"Action": [
"scheduler:ListSchedules",
"scheduler:ListScheduleGroups"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IAMPassEC2InstanceRole",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/atx-transform-role",
"arn:aws:iam::*:role/atx-transform-role-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IAMPassSchedulerRole",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/AtxSchedulerInvocationRole",
"arn:aws:iam::*:role/AtxSchedulerInvocationRole-*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "scheduler.amazonaws.com",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IAMReadRoles",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:GetRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/atx-*",
"arn:aws:iam::*:role/Atx*",
"arn:aws:iam::*:role/ATX*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "IAMReadInstanceProfile",
"Effect": "Allow",
"Action": "iam:GetInstanceProfile",
"Resource": [
"arn:aws:iam::*:instance-profile/atx-*",
"arn:aws:iam::*:instance-profile/Atx*",
"arn:aws:iam::*:instance-profile/ATX*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "TagGetATXStacks",
"Effect": "Allow",
"Action": "tag:GetResources",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CFNListStacksForDetect",
"Effect": "Allow",
"Action": "cloudformation:ListStacks",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SQSEnqueueToDispatcher",
"Effect": "Allow",
"Action": "sqs:SendMessage",
"Resource": "arn:aws:sqs:*:*:atx-dispatcher-queue",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-09-02T21:27:07+00:00"
}
}Version History (3 recorded)
Raw historyv3updated
1 action added
v2updated
scope changed, no action added or removed
v1new policy
48 actions added
Permissions management: iam:PassRole: iam:PassRole