Deprecated
Removed from AWS on 2023-12-04 - Active for 8 months
AmazonDataZoneProjectDeploymentPermissionsBoundary
Last Modified
Apr 4, 2023
April 4, 2023 at 03:14 AM UTC
Version
v2
Total Versions
2
Created
Apr 4, 2023
Actions
168
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can change identities and their permissions
Grants 1 permissions management action on IAM, IAM Identity Center or Organizations, on any resource with no condition.
iam:createpolicyUse with caution: Grant it only to identity administrators, and protect your admin roles and SCPs with a permissions boundary or an SCP of their own.
- Medium
Can grant itself more permissions
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PutRolePolicy: condition iam:PermissionsBoundary, on arn:aws:iam::*:role/*datazone*
- iam:AttachRolePolicy: condition iam:PermissionsBoundary, on arn:aws:iam::*:role/*datazone*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: on arn:aws:iam::*:role/*datazone*
- cloudformation:CreateStack: on arn:aws:cloudformation:*:*:stack/DataZone*
- cloudformation:CreateChangeSet: on arn:aws:cloudformation:*:*:stack/DataZone*
- cloudformation:ExecuteChangeSet: on arn:aws:cloudformation:*:*:stack/DataZone*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- cloudformation:UpdateStack: on arn:aws:cloudformation:*:*:stack/DataZone*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can switch off security monitoring
Can delete CloudWatch log groups, which is how an intruder hides.
logs:DeleteLogGroupUse with caution: Deny these actions with an SCP for everyone outside a break-glass role, so no single policy can blind you.
- Medium
Can rewrite resource policies and sharing
Grants 1 permissions management action across 1 service (lakeformation) on any resource, enough to share resources outside the account.
lakeformation:revokepermissionsUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"iam:AttachRolePolicy",
"iam:PutRolePolicy"
],
"Resource": "arn:aws:iam::*:role/*datazone*",
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:DeleteRole"
],
"Resource": [
"arn:aws:iam::*:role/*datazone*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:CreateKey",
"kms:TagResource",
"athena:CreateWorkGroup",
"athena:TagResource",
"iam:TagRole",
"iam:TagPolicy",
"logs:CreateLogGroup",
"logs:TagLogGroup",
"ssm:AddTagsToResource"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "datazone:*"
},
"StringLike": {
"aws:ResourceTag/datazone:projectId": "proj-*"
}
}
},
{
"Effect": "Allow",
"Action": [
"athena:DeleteWorkGroup",
"kms:ScheduleKeyDeletion",
"kms:DescribeKey",
"kms:EnableKeyRotation",
"kms:DisableKeyRotation",
"kms:GenerateDataKey",
"kms:Encrypt",
"kms:Decrypt",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:ResourceTag/datazone:projectId": "proj-*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "datazone:projectId"
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:DeletePolicy",
"s3:DeleteBucket"
],
"Resource": [
"arn:aws:iam::*:policy/datazone*",
"arn:aws:s3:::datazone*"
]
},
{
"Effect": "Allow",
"Action": [
"ssm:GetParameter*",
"ssm:PutParameter",
"ssm:DeleteParameter"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/*datazone*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:GetPolicy",
"iam:GetRolePolicy",
"iam:CreatePolicy",
"iam:ListPolicyVersions",
"lakeformation:RegisterResource",
"lakeformation:DeregisterResource",
"lakeformation:GrantPermissions",
"lakeformation:PutDataLakeSettings",
"lakeformation:GetDataLakeSettings",
"lakeformation:RevokePermissions",
"lakeformation:ListPermissions",
"glue:CreateDatabase",
"glue:DeleteDatabase",
"glue:GetDatabases",
"glue:GetDatabase",
"sts:GetCallerIdentity"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/*datazone*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutEncryptionConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:DeleteBucketPolicy",
"s3:CreateBucket",
"s3:PutBucketPolicy",
"s3:PutBucketAcl",
"s3:PutBucketVersioning",
"s3:PutBucketTagging",
"s3:PutBucketLogging",
"s3:GetObject*",
"s3:GetBucket*",
"s3:List*",
"s3:GetEncryptionConfiguration",
"s3:DeleteObject*",
"s3:PutObject*",
"s3:Abort*"
],
"Resource": "arn:aws:s3:::*datazone*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Effect": "Allow",
"Action": [
"athena:Get*",
"athena:List*",
"ec2:CreateSecurityGroup",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup",
"ec2:Describe*",
"ec2:Get*",
"ec2:List*",
"logs:PutRetentionPolicy",
"logs:DescribeLogGroups",
"logs:DeleteLogGroup",
"logs:DeleteRetentionPolicy"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:PutKeyPolicy"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": "ec2:CreateVpcEndpoint",
"NotResource": "arn:aws:ec2:*:*:vpc-endpoint/*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
"Condition": {
"StringLike": {
"ec2:VpceServiceName": [
"com.amazonaws.*.logs",
"com.amazonaws.*.s3",
"com.amazonaws.*.glue",
"com.amazonaws.*.athena"
]
}
}
},
{
"Action": [
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents",
"cloudformation:GetTemplate",
"cloudformation:DescribeChangeSet",
"cloudformation:CreateChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:TagResource",
"cloudformation:GetTemplateSummary"
],
"Effect": "Allow",
"Resource": [
"arn:aws:cloudformation:*:*:stack/DataZone*"
]
},
{
"Effect": "Deny",
"Action": [
"s3:GetObject*",
"s3:GetBucket*",
"s3:List*",
"s3:GetEncryptionConfiguration",
"s3:DeleteObject*",
"s3:PutObject*",
"s3:Abort*",
"s3:DeleteBucket"
],
"NotResource": [
"arn:aws:s3:::*datazone*"
]
},
{
"Effect": "Deny",
"Action": [
"kms:*"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Effect": "Deny",
"NotAction": [
"ssm:PutParameter",
"ssm:DeleteParameter",
"ssm:AddTagsToResource",
"ssm:GetParameters",
"ssm:GetParameter",
"s3:PutEncryptionConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:DeleteBucketPolicy",
"s3:CreateBucket",
"s3:PutBucketAcl",
"s3:PutBucketPolicy",
"s3:PutBucketVersioning",
"s3:PutBucketTagging",
"s3:ListBucket",
"s3:PutBucketLogging",
"s3:DeleteBucket",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetPolicy",
"iam:CreatePolicy",
"iam:ListPolicyVersions",
"iam:DeletePolicy",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents",
"cloudformation:GetTemplate",
"cloudformation:DescribeChangeSet",
"cloudformation:CreateChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:TagResource",
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:GetTemplateSummary",
"athena:*",
"kms:*",
"glue:CreateDatabase",
"glue:DeleteDatabase",
"glue:GetDatabases",
"glue:GetDatabase",
"lambda:*",
"ec2:*",
"logs:*",
"servicecatalog:CreateApplication",
"servicecatalog:DeleteApplication",
"servicecatalog:GetApplication",
"lakeformation:RegisterResource",
"lakeformation:DeregisterResource",
"lakeformation:GrantPermissions",
"lakeformation:PutDataLakeSettings",
"lakeformation:RevokePermissions",
"lakeformation:GetDataLakeSettings",
"lakeformation:ListPermissions",
"iam:CreateRole",
"iam:DeleteRole",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"iam:AttachRolePolicy",
"iam:PutRolePolicy",
"iam:UntagRole",
"iam:PassRole",
"iam:TagRole",
"s3:GetBucket*",
"s3:GetObject*",
"s3:Abort*",
"s3:GetEncryptionConfiguration",
"s3:PutObject*"
],
"Resource": [
"*"
]
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2023-04-04T02:48:38Z"
}
}Version History (2 recorded)
Raw historyUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 4, 2023
806910bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 21, 2023
1b15c44