AmazonDataZoneRedshiftGlueProvisioningPolicy
Last Modified
Aug 21, 2026
August 21, 2026 at 11:03 PM UTC
Version
v5
Total Versions
5
Created
Aug 21, 2026
Actions
55
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PutRolePolicy: condition aws:CalledViaFirst, iam:PermissionsBoundary, on arn:aws:iam::*:role/datazone*
- iam:AttachRolePolicy: condition aws:CalledViaFirst, iam:PermissionsBoundary, on arn:aws:iam::*:role/datazone*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition aws:CalledViaFirst, iam:PassedToService, on arn:aws:iam::*:role/datazone*
- cloudformation:CreateStack: condition aws:ResourceTag/AmazonDataZoneEnvironment, aws:TagKeys, on arn:aws:cloudformation:*:*:stack/DataZone*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can rewrite resource policies and sharing
Grants 1 permissions management action across 1 service (lakeformation) on any resource, enough to share resources outside the account.
lakeformation:revokepermissionsUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"iam:AttachRolePolicy",
"iam:PutRolePolicy"
],
"Resource": "arn:aws:iam::*:role/datazone*",
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary",
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "IamPassRolePermissions",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/datazone*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"glue.amazonaws.com",
"lakeformation.amazonaws.com"
],
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZonePermissionsToManageCreatedEnvironmentRole",
"Effect": "Allow",
"Action": [
"iam:DeleteRole",
"iam:GetRole"
],
"Resource": "arn:aws:iam::*:role/datazone*",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneCFStackCreationForEnvironments",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/DataZone*"
],
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "AmazonDataZoneEnvironment"
},
"Null": {
"aws:ResourceTag/AmazonDataZoneEnvironment": "false"
}
}
},
{
"Sid": "AmazonDataZoneCFStackManagementForEnvironments",
"Effect": "Allow",
"Action": [
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/DataZone*"
]
},
{
"Sid": "AmazonDataZoneEnvironmentParameterValidation",
"Effect": "Allow",
"Action": [
"lakeformation:GetDataLakeSettings",
"lakeformation:PutDataLakeSettings",
"lakeformation:RevokePermissions",
"lakeformation:ListPermissions",
"glue:CreateDatabase",
"glue:GetDatabase",
"athena:GetWorkGroup",
"logs:DescribeLogGroups",
"redshift-serverless:GetNamespace",
"redshift-serverless:GetWorkgroup",
"redshift:DescribeClusters",
"secretsmanager:ListSecrets"
],
"Resource": "*"
},
{
"Sid": "AmazonDataZoneEnvironmentLakeFormationPermissions",
"Effect": "Allow",
"Action": [
"lakeformation:RegisterResource",
"lakeformation:DeregisterResource",
"lakeformation:GrantPermissions",
"lakeformation:ListResources"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentGlueDeletePermissions",
"Effect": "Allow",
"Action": [
"glue:DeleteDatabase"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentAthenaDeletePermissions",
"Effect": "Allow",
"Action": [
"athena:DeleteWorkGroup"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentAthenaResourceCreation",
"Effect": "Allow",
"Action": [
"athena:CreateWorkGroup",
"athena:TagResource",
"iam:TagRole",
"iam:TagPolicy",
"logs:TagLogGroup"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "AmazonDataZoneEnvironment"
},
"Null": {
"aws:ResourceTag/AmazonDataZoneEnvironment": "false"
},
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentLogGroupCreation",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:DeleteLogGroup"
],
"Resource": "arn:aws:logs:*:*:log-group:datazone-*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "AmazonDataZoneEnvironment"
},
"Null": {
"aws:ResourceTag/AmazonDataZoneEnvironment": "false"
},
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentLogGroupManagement",
"Action": [
"logs:PutRetentionPolicy"
],
"Resource": "arn:aws:logs:*:*:log-group:datazone-*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentIAMPolicyManagement",
"Effect": "Allow",
"Action": [
"iam:DeletePolicy",
"iam:CreatePolicy",
"iam:GetPolicy",
"iam:ListPolicyVersions",
"iam:DeletePolicyVersion"
],
"Resource": [
"arn:aws:iam::*:policy/datazone*"
],
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "AmazonDataZoneEnvironmentS3ValidationPermissions",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "AmazonDataZoneEnvironmentKMSDecryptPermissions",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"Null": {
"aws:ResourceTag/AmazonDataZoneEnvironment": "false"
}
}
},
{
"Sid": "PermissionsToTagAmazonDataZoneEnvironmentGlueResources",
"Effect": "Allow",
"Action": [
"glue:TagResource"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:TagKeys": "AmazonDataZoneEnvironment"
},
"Null": {
"aws:RequestTag/AmazonDataZoneEnvironment": "false"
}
}
},
{
"Sid": "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringEquals": {
"aws:CalledViaFirst": [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid": "RedshiftDataPermissions",
"Effect": "Allow",
"Action": [
"redshift-data:ListSchemas",
"redshift-data:ExecuteStatement"
],
"Resource": [
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid": "DescribeStatementPermissions",
"Effect": "Allow",
"Action": [
"redshift-data:DescribeStatement"
],
"Resource": "*"
},
{
"Sid": "GetSecretValuePermissions",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "*",
"Condition": {
"StringLike": {
"secretsmanager:ResourceTag/AmazonDataZoneDomain": "dzd*"
}
}
}
]
},
"VersionId": "v5",
"IsDefaultVersion": true,
"CreateDate": "2026-08-21T22:27:22+00:00"
}
}Version History (8 recorded)
Raw history1 action added
AmazonDataZoneRedshiftGlueProvisioningPolicy - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
5916034Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 23, 2024
5b64700Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2024
ae1ab94Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 23, 2023
c3815c7Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 22, 2023
b7d0a73