AWSTransformLandingZoneAgentPolicy
Last Modified
Oct 6, 2026
October 6, 2026 at 08:02 AM UTC
Version
v3
Total Versions
3
Created
Oct 6, 2026
Actions
62
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:CreateChangeSet: condition aws:RequestedRegion, aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/AtxLz*
- cloudformation:ExecuteChangeSet: condition aws:RequestedRegion, aws:ResourceAccount, on arn:aws:cloudformation:*:*:stack/AtxLz*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: condition aws:RequestTag/CreatedBy, aws:RequestedRegion, aws:ResourceAccount, aws:ResourceTag/CreatedBy, on arn:aws:cloudformation:*:*:stack/AtxLz*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (7)
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
- Error / INVALID_REGION
The Region ${aws:PrincipalTag/TargetRegion} is not valid. Update the condition value to a supported Region. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3LandingZoneBucketAndObjectOperations",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:GetBucketLocation",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:GetObject",
"s3:GetObjectAttributes",
"s3:GetObjectVersion",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutBucketPolicy",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::transform-vmware-landing-zone-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CfnLandingZoneStackCreate",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:TagResource"
],
"Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CfnLandingZoneStackUpdate",
"Effect": "Allow",
"Action": [
"cloudformation:UpdateStack"
],
"Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceTag/CreatedBy": "AWSTransform",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CfnLandingZoneStackOperationsAndChangeSets",
"Effect": "Allow",
"Action": [
"cloudformation:CreateChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStacks",
"cloudformation:ExecuteChangeSet",
"cloudformation:GetTemplate",
"cloudformation:ListChangeSets"
],
"Resource": "arn:aws:cloudformation:*:*:stack/AtxLz*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ControlTowerAndOrganizationsOperationsReadOnly",
"Effect": "Allow",
"Action": [
"controltower:GetBaselineOperation",
"controltower:GetControlOperation",
"controltower:ListBaselines",
"controltower:ListEnabledBaselines",
"controltower:ListEnabledControls",
"controltower:ListLandingZones",
"organizations:DescribeCreateAccountStatus",
"organizations:DescribeOrganization",
"organizations:ListPolicies",
"organizations:ListRoots"
],
"Resource": "*"
},
{
"Sid": "ControlTowerResourceOperationsReadOnly",
"Effect": "Allow",
"Action": [
"controltower:GetEnabledBaseline",
"controltower:GetEnabledControl",
"controltower:GetLandingZone",
"controltower:ListTagsForResource"
],
"Resource": [
"arn:aws:controltower:*:*:enabledbaseline/*",
"arn:aws:controltower:*:*:enabledcontrol/*",
"arn:aws:controltower:*:*:landingzone/*"
],
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ControlTowerBaselineOperationsReadOnly",
"Effect": "Allow",
"Action": [
"controltower:GetBaseline"
],
"Resource": "arn:aws:controltower:*::baseline/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}"
}
}
},
{
"Sid": "ControlTowerEnableControlWithRequestTag",
"Effect": "Allow",
"Action": [
"controltower:EnableControl"
],
"Resource": "arn:aws:controltower:*:*:enabledcontrol/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ControlTowerEnableBaselineAndOrganizationsAccountCreate",
"Effect": "Allow",
"Action": [
"controltower:EnableBaseline",
"controltower:TagResource",
"organizations:CreateAccount"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform"
}
}
},
{
"Sid": "OrganizationsTagAndCreateOrganizationalUnit",
"Effect": "Allow",
"Action": [
"organizations:CreateOrganizationalUnit",
"organizations:TagResource"
],
"Resource": [
"arn:aws:organizations::*:account/o-*/*",
"arn:aws:organizations::*:ou/o-*/*",
"arn:aws:organizations::*:policy/o-*/*",
"arn:aws:organizations::*:root/o-*/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:RequestTag/CreatedBy": "AWSTransform",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "OrganizationsResourceDescribeReadOnly",
"Effect": "Allow",
"Action": [
"organizations:DescribeAccount",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribePolicy"
],
"Resource": [
"arn:aws:organizations::*:account/*",
"arn:aws:organizations::*:ou/*",
"arn:aws:organizations::*:policy/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "OrganizationsPolicyUpdateViaControlTower",
"Effect": "Allow",
"Action": [
"organizations:UpdatePolicy"
],
"Resource": "arn:aws:organizations::*:policy/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "controltower.amazonaws.com"
},
"StringEquals": {
"organizations:PolicyType": "SERVICE_CONTROL_POLICY",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "OrganizationsHierarchyOperationsReadOnly",
"Effect": "Allow",
"Action": [
"organizations:ListAccountsForParent",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListParents"
],
"Resource": [
"arn:aws:organizations::*:account/*",
"arn:aws:organizations::*:ou/*",
"arn:aws:organizations::*:root/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "OrganizationsMoveAccountWithResourceTag",
"Effect": "Allow",
"Action": [
"organizations:MoveAccount"
],
"Resource": [
"arn:aws:organizations::*:account/*",
"arn:aws:organizations::*:ou/*",
"arn:aws:organizations::*:root/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/ATWorkspace": "${aws:PrincipalTag/WorkspaceId}",
"aws:ResourceTag/CreatedBy": "AWSTransform",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "OrganizationsListTagsForResource",
"Effect": "Allow",
"Action": [
"organizations:ListTagsForResource"
],
"Resource": [
"arn:aws:organizations::*:account/o-*/*",
"arn:aws:organizations::*:ou/o-*/*",
"arn:aws:organizations::*:policy/o-*/*",
"arn:aws:organizations::*:root/o-*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceOrgID": "${aws:PrincipalOrgID}"
}
}
},
{
"Sid": "OrganizationsServiceControlPolicyCreateViaControlTower",
"Effect": "Allow",
"Action": [
"organizations:CreatePolicy"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "controltower.amazonaws.com"
},
"StringEquals": {
"organizations:PolicyType": "SERVICE_CONTROL_POLICY"
}
}
},
{
"Sid": "OrganizationsServiceControlPolicyAttachViaControlTower",
"Effect": "Allow",
"Action": [
"organizations:AttachPolicy"
],
"Resource": [
"arn:aws:organizations::*:account/o-*/*",
"arn:aws:organizations::*:ou/o-*/*",
"arn:aws:organizations::*:policy/o-*/*",
"arn:aws:organizations::*:root/o-*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "controltower.amazonaws.com"
},
"StringEquals": {
"organizations:PolicyType": "SERVICE_CONTROL_POLICY",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ServiceCatalogProvisioningArtifactOperations",
"Effect": "Allow",
"Action": [
"servicecatalog:CreateProvisioningArtifact",
"servicecatalog:DeleteProvisioningArtifact",
"servicecatalog:ListProvisioningArtifacts",
"servicecatalog:UpdateProvisioningArtifact"
],
"Resource": "arn:aws:catalog:*:*:product/*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "${aws:PrincipalTag/TargetRegion}",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-10-06T07:37:08+00:00"
}
}Version History (3 recorded)
Raw historyv3updated
scope changed, no action added or removed
v2updated
1 action added
Permissions management: s3:PutBucketPolicy: s3:PutBucketPolicy
v1new policy
61 actions added
5 never-before-seen actions: controltower:EnableBaseline, controltower:EnableControl, controltower:GetBaseline, controltower:TagResource, organizations:CreateOrganizationalUnit
2 permissions management, incl. organizations:AttachPolicy: organizations:AttachPolicy, organizations:UpdatePolicy