AmazonInspector2AmiScanServiceRolePolicy

Last Modified

Jul 30, 2026

July 30, 2026 at 06:03 PM UTC

Version

v1

Total Versions

1

Created

Jul 30, 2026

Actions

26

Subscribe to updates

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • High

    Can switch off security monitoring

    Can disable Inspector, which is how an intruder hides.

    inspector2:Disable

    Use with caution: Deny these actions with an SCP for everyone outside a break-glass role, so no single policy can blind you.

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "ManagedRules",
          "Effect": "Allow",
          "Action": [
            "events:DeleteRule",
            "events:DescribeRule",
            "events:ListTargetsByRule",
            "events:PutRule",
            "events:PutTargets",
            "events:RemoveTargets"
          ],
          "Resource": [
            "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule"
          ]
        },
        {
          "Sid": "AllowInspectorEnablementForAwsOrgPolicy",
          "Effect": "Allow",
          "Action": [
            "inspector2:AssociateMember",
            "inspector2:Disable",
            "inspector2:Enable",
            "inspector2:EnableDelegatedAdminAccount"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowInspectorServiceGetAwsOrg",
          "Effect": "Allow",
          "Action": [
            "organizations:DescribeAccount",
            "organizations:DescribeOrganization",
            "organizations:ListAccounts"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowInspectorServiceDelegatedAdminFromAwsOrg",
          "Effect": "Allow",
          "Action": [
            "organizations:ListDelegatedAdministrators"
          ],
          "Resource": "*",
          "Condition": {
            "StringLikeIfExists": {
              "organizations:ServicePrincipal": [
                "ami.inspector2.amazonaws.com",
                "inspector2.amazonaws.com"
              ]
            }
          }
        },
        {
          "Sid": "AmiIdentification",
          "Effect": "Allow",
          "Action": [
            "ec2:DescribeImages",
            "ec2:DescribeSnapshots",
            "ec2:DescribeVolumes"
          ],
          "Resource": "*"
        },
        {
          "Sid": "GetSnapshotData",
          "Effect": "Allow",
          "Action": [
            "ebs:GetSnapshotBlock",
            "ebs:ListSnapshotBlocks"
          ],
          "Resource": "arn:aws:ec2:*:*:snapshot/*"
        },
        {
          "Sid": "DenyGetSnapshotDataOnExcludedSnapshots",
          "Effect": "Deny",
          "Action": [
            "ebs:GetSnapshotBlock",
            "ebs:ListSnapshotBlocks"
          ],
          "Resource": "arn:aws:ec2:*:*:snapshot/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/InspectorEc2Exclusion": "true"
            }
          }
        },
        {
          "Sid": "DenyKmsDecryptForExcludedKeys",
          "Effect": "Deny",
          "Action": "kms:Decrypt",
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceTag/InspectorEc2Exclusion": "true"
            }
          }
        },
        {
          "Sid": "DecryptSnapshotBlocksVolContext",
          "Effect": "Allow",
          "Action": "kms:Decrypt",
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            },
            "StringLike": {
              "kms:EncryptionContext:aws:ebs:id": "vol-*",
              "kms:ViaService": "ec2.*.amazonaws.com"
            }
          }
        },
        {
          "Sid": "DecryptSnapshotBlocksSnapContext",
          "Effect": "Allow",
          "Action": "kms:Decrypt",
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            },
            "StringLike": {
              "kms:EncryptionContext:aws:ebs:id": "snap-*",
              "kms:ViaService": "ec2.*.amazonaws.com"
            }
          }
        },
        {
          "Sid": "DescribeKeysForEbsOperations",
          "Effect": "Allow",
          "Action": "kms:DescribeKey",
          "Resource": "arn:aws:kms:*:*:key/*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            },
            "StringLike": {
              "kms:ViaService": "ec2.*.amazonaws.com"
            }
          }
        },
        {
          "Sid": "ListKeyResourceTags",
          "Effect": "Allow",
          "Action": "kms:ListResourceTags",
          "Resource": "arn:aws:kms:*:*:key/*"
        }
      ]
    },
    "VersionId": "v1",
    "IsDefaultVersion": true,
    "CreateDate": "2026-07-30T17:57:10+00:00"
  }
}

Version History (1 recorded)

Raw history
v1new policy

22 actions added

d5640c3