Deprecated
Removed from AWS on 2021-04-02 - Active for 1 year, 6 months
AmazonApplicationWizardFullaccess
Last Modified
Oct 16, 2019
October 16, 2019 at 01:43 AM UTC
Version
v1
Total Versions
1
Created
Oct 16, 2019
Actions
179
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can read secrets
Reads Parameter Store values, SecureString included where the KMS key allows it, on any resource with no condition.
ssm:GetParameter (via ssm:GetParameter*)ssm:GetParameters (via ssm:GetParameter*)ssm:GetParametersByPath (via ssm:GetParameter*)Use with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 3 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForApplicationWizard*, arn:aws:iam::*:instance-profile/ApplicationWizard*
- cloudformation:CreateStack: condition aws:TagKeys
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForApplicationWizard*, arn:aws:iam::*:instance-profile/ApplicationWizard*
- ec2:RunInstances: condition aws:TagKeys
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForApplicationWizard*, arn:aws:iam::*:instance-profile/ApplicationWizard*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ec2:ModifyInstanceAttribute: condition aws:TagKeys
- ec2:StopInstances: condition aws:TagKeys
- ec2:StartInstances: condition aws:TagKeys
- ssm:SendCommand: condition aws:TagKeys
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can rewrite resource policies and sharing
Grants 1 permissions management action across 1 service (ec2) on any resource, enough to share resources outside the account.
ec2:deletenetworkinterfacepermissionUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full applicationwizard access on every resource
Uses applicationwizard:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
applicationwizard:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStack*",
"cloudformation:Get*",
"cloudformation:ListStacks",
"cloudformation:SignalResource",
"ec2:AllocateAddress",
"ec2:AllocateHosts",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:AssociateDhcpOptions",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVolume",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreateNetworkInterface",
"ec2:CreateSecurityGroup",
"ec2:CreateVolume",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSnapshot",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:DisassociateIamInstanceProfile",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
"ec2:GetConsoleOutput",
"ec2:GetPasswordData",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVolumeAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceRouteTableAssociation",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RunInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ssm:SendCommand"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "ApplicationWizardResourceGroupID"
}
}
},
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:PassRole",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonEC2RoleForApplicationWizard*",
"arn:aws:iam::*:instance-profile/ApplicationWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:AttachInstances",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:UpdateAutoScalingGroup",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DeleteLogStream",
"logs:DescribeLog*",
"logs:PutLogEvents",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"sns:ListSubscriptionsByTopic",
"sns:Publish",
"ssm:DeleteDocument",
"ssm:DeleteParameter*",
"ssm:DescribeDocument*",
"ssm:GetDocument",
"ssm:PutParameter"
],
"Resource": [
"arn:aws:resource-groups:*:*:group/ApplicationWizard*",
"arn:aws:sns:*:*:*",
"arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/ApplicationWizard*",
"arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/ApplicationWizard*",
"arn:aws:ssm:*:*:parameter/ApplicationWizard*",
"arn:aws:ssm:*:*:document/ApplicationWizard*",
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:ApplicationWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"logs:DeleteLogStream",
"logs:GetLogEvents",
"logs:PutLogEvents",
"ssm:AddTagsToResource",
"ssm:AddTagsToResource",
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListTagsForResource",
"ssm:RemoveTagsFromResource",
"ssm:RemoveTagsToResource"
],
"Resource": [
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:ApplicationWizard*",
"arn:aws:ssm:*:*:parameter/ApplicationWizard*",
"arn:aws:ssm:*:*:document/ApplicationWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScaling*",
"autoscaling:DescribeLaunchConfigurations",
"autoscaling:DescribeNotificationConfigurations",
"autoscaling:DescribePolicies",
"autoscaling:DescribeScaling*",
"autoscaling:DescribeScheduledActions",
"cloudformation:DescribeAccountLimits",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:List*",
"ds:AddIpRoutes",
"ds:CreateComputer",
"ds:CreateMicrosoftAD",
"ds:DeleteDirectory",
"ds:Describe*",
"ds:ListAuthorizedApplications",
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:CreateInternetGateway",
"ec2:CreateKeyPair",
"ec2:CreateNatGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeDhcpOptions",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeImage*",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeKeyPairs",
"ec2:DescribeNatGateways",
"ec2:DescribeNetwork*",
"ec2:DescribeRegions",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshot*",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVolume*",
"ec2:DescribeVpc*",
"ec2:DetachNetworkInterface",
"ec2:DisassociateAddress",
"ec2:DisassociateVpcCidrBlock",
"ec2:GetLaunchTemplateData",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifyVolume",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:List*",
"logs:CreateLogGroup",
"logs:GetLogDelivery",
"logs:GetLogRecord",
"logs:ListLogDeliveries",
"resource-groups:Get*",
"resource-groups:List*",
"servicequotas:GetServiceQuota",
"servicequotas:ListServiceQuotas",
"sns:ListSubscriptions",
"sns:ListTopics",
"ssm:CreateDocument",
"ssm:DescribeAutomation*",
"ssm:DescribeInstanceInformation",
"ssm:DescribeParameters",
"ssm:GetAutomationExecution",
"ssm:GetCommandInvocation",
"ssm:GetParameter*",
"ssm:ListCommand*",
"ssm:ListDocument*",
"ssm:ListInstanceAssociations",
"ssm:SendAutomationSignal",
"ssm:StartAutomationExecution",
"ssm:StopAutomationExecution",
"tag:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "logs:GetLog*",
"Resource": [
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:ApplicationWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "arn:aws:cloudformation:::stack/ApplicationWizard*/"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*"
]
},
{
"Effect": "Allow",
"Action": "applicationwizard:*",
"Resource": "*"
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2019-10-16T00:29:24Z"
}
}Version History (1 recorded)
Raw historyUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 16, 2019
bccc7ee