AmazonLaunchWizardFullAccessV2
Last Modified
Oct 20, 2026
October 20, 2026 at 05:04 PM UTC
Version
v3
Total Versions
3
Created
Oct 20, 2026
Actions
319
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can read secrets
Reads Parameter Store values, SecureString included where the KMS key allows it, on any resource with no condition.
ssm:GetParameter (via ssm:GetParameter*)ssm:GetParameters (via ssm:GetParameter*)ssm:GetParametersByPath (via ssm:GetParameter*)Use with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 4 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard, arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard, arn:aws:iam::*:instance-profile/LaunchWizard*
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard, arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard, arn:aws:iam::*:instance-profile/LaunchWizard*
- ec2:RunInstances: condition aws:CalledVia, on arn:aws:ec2:*:*:instance/*, arn:aws:ec2:*:*:image/*, arn:aws:ec2:*:*:subnet/*
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard, arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard, arn:aws:iam::*:instance-profile/LaunchWizard*
- lambda:CreateFunction: on arn:aws:lambda:*:*:function:LaunchWizard*, arn:aws:s3:::launchwizard*
- lambda:InvokeFunction: on arn:aws:lambda:*:*:function:LaunchWizard*, arn:aws:s3:::launchwizard*
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard, arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard, arn:aws:iam::*:instance-profile/LaunchWizard*
- ssm:StartAutomationExecution: condition aws:CalledVia, on arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ec2:ModifyInstanceAttribute: condition ec2:ResourceTag/aws:cloudformation:stack-id, on arn:aws:ec2:*:*:instance/*
- ec2:StopInstances: condition ec2:ResourceTag/aws:cloudformation:stack-id, on arn:aws:ec2:*:*:instance/*
- ec2:StartInstances: condition ec2:ResourceTag/aws:cloudformation:stack-id, on arn:aws:ec2:*:*:instance/*
- ssm:SendCommand: on arn:aws:ssm:*::document/AWS-RunShellScript
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Full access to 2 services on every resource
Uses applicationinsights:*, launchwizard:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
applicationinsights:*launchwizard:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
IAM Access Analyzer (3)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 18207 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:s3:::launchwizard*/* to remove the redundancy. AWS docs
- Suggestion / REDUNDANT_RESOURCE
The 2 resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*), or remove the resource arn:aws:logs:*:*:log-group:LaunchWizard*:log-stream:* to remove the redundancy. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AppInsightsActions0",
"Effect": "Allow",
"Action": "applicationinsights:*",
"Resource": "*"
},
{
"Sid": "ResourceGroupActions0",
"Effect": "Allow",
"Action": "resource-groups:List*",
"Resource": "*"
},
{
"Sid": "Route53Actions0",
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets",
"route53:GetChange",
"route53:ListResourceRecordSets",
"route53:ListHostedZones",
"route53:ListHostedZonesByName"
],
"Resource": "*"
},
{
"Sid": "S3Actions0",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource": "*"
},
{
"Sid": "KmsActions0",
"Effect": "Allow",
"Action": [
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Sid": "CloudWatchActions0",
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Get*",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Sid": "Ec2Actions0",
"Effect": "Allow",
"Action": [
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreateVpc",
"ec2:CreateKeyPair",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet"
],
"Resource": "*"
},
{
"Sid": "Ec2Actions1",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:AllocateHosts",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVolumeAttribute",
"ec2:ModifyVpcAttribute",
"ec2:AssociateDhcpOptions",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVolume",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:DeleteSnapshot",
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:DetachNetworkInterface",
"ec2:DisassociateAddress",
"ec2:DisassociateVpcCidrBlock",
"ec2:GetLaunchTemplateData",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifyVolume",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceRouteTableAssociation",
"ec2:DisassociateIamInstanceProfile",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
"ec2:ModifyInstancePlacement",
"elasticfilesystem:DeleteFileSystem",
"elasticfilesystem:DeleteMountTarget",
"ds:AddIpRoutes",
"ds:CreateComputer",
"ds:CreateMicrosoftAD",
"ds:DeleteDirectory",
"servicecatalog:AssociateProductWithPortfolio",
"cloudformation:GetTemplateSummary",
"sts:GetCallerIdentity"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2InstanceActions0",
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:TerminateInstances",
"ec2:ModifyInstanceAttribute",
"ec2:GetConsoleOutput",
"ec2:GetPasswordData"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Sid": "Ec2RunInstancesActions0",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:image/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:key-pair/*",
"arn:aws:ec2:*:*:placement-group/*",
"arn:aws:ec2:*:*:launch-template/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2SecurityGroupActions0",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": "arn:aws:ec2:*:*:security-group/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2TagActions0",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:route-table/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2VolumeActions0",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2NetworkInterfaceActions0",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2VpcEndpointActions0",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "CloudFormationActions0",
"Effect": "Allow",
"Action": [
"cloudformation:DescribeStack*",
"cloudformation:Get*",
"cloudformation:ListStacks",
"cloudformation:SignalResource",
"cloudformation:DeleteStack"
],
"Resource": [
"arn:aws:cloudformation:*:*:stack/LaunchWizard*/*",
"arn:aws:cloudformation:*:*:stack/ApplicationInsights*/*"
]
},
{
"Sid": "CloudFormationActions1",
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "arn:aws:cloudformation:*:*:stack/LaunchWizard*/"
},
{
"Sid": "CloudFormationActions2",
"Effect": "Allow",
"Action": [
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "LaunchWizard*"
}
}
},
{
"Sid": "IamActions0",
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*",
"arn:aws:iam::*:instance-profile/LaunchWizard*"
]
},
{
"Sid": "IamActions1",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard",
"arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard",
"arn:aws:iam::*:instance-profile/LaunchWizard*"
],
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": [
"lambda.amazonaws.com",
"ec2.amazonaws.com",
"ec2.amazonaws.com.cn",
"ssm.amazonaws.com"
]
}
}
},
{
"Sid": "IamActions2",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"autoscaling.amazonaws.com",
"application-insights.amazonaws.com",
"events.amazonaws.com",
"autoscaling.amazonaws.com.cn",
"events.amazonaws.com.cn"
]
}
}
},
{
"Sid": "LaunchWizardActions0",
"Effect": "Allow",
"Action": "launchwizard:*",
"Resource": "*"
},
{
"Sid": "AutoScalingActions0",
"Effect": "Allow",
"Action": [
"autoscaling:AttachInstances",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:UpdateAutoScalingGroup",
"autoscaling:CreateOrUpdateTags",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"sns:ListSubscriptionsByTopic",
"sns:Publish",
"ssm:DeleteDocument",
"ssm:DeleteParameter*",
"ssm:DescribeDocument*",
"ssm:GetDocument",
"ssm:PutParameter"
],
"Resource": [
"arn:aws:resource-groups:*:*:group/LaunchWizard*",
"arn:aws:sns:*:*:*",
"arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*",
"arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*",
"arn:aws:ssm:*:*:parameter/LaunchWizard*",
"arn:aws:ssm:*:*:document/LaunchWizard*"
]
},
{
"Sid": "SsmActions0",
"Effect": "Allow",
"Action": [
"ssm:GetDocument",
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ssm:*::document/AWS-RunShellScript"
]
},
{
"Sid": "SsmActions1",
"Effect": "Allow",
"Action": [
"ssm:SendCommand"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Sid": "SsmActions2",
"Effect": "Allow",
"Action": [
"ssm:AddTagsToResource",
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListTagsForResource",
"ssm:RemoveTagsFromResource"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/LaunchWizard*",
"arn:aws:ssm:*:*:document/LaunchWizard*"
]
},
{
"Sid": "SsmActions3",
"Effect": "Allow",
"Action": [
"autoscaling:Describe*",
"cloudformation:DescribeAccountLimits",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:List*",
"cloudformation:ValidateTemplate",
"ds:Describe*",
"ds:ListAuthorizedApplications",
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeVpcAttribute",
"ec2:DescribeImages",
"ec2:DescribeKeyPairs",
"ec2:DescribeVolumes",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumeAttribute",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeHosts",
"ec2:DescribeTags",
"ec2:DescribeInstanceTypes",
"ec2:DescribeAccountAttributes",
"ec2:DescribeDhcpOptions",
"ec2:DescribeInternetGateways",
"ec2:DescribeNatGateways",
"ec2:DescribeRouteTables",
"ec2:DescribeAddresses",
"ec2:DescribeFlowLogs",
"ec2:DescribeLaunchTemplates",
"ec2:DescribeLaunchTemplateVersions",
"ec2:DescribeStaleSecurityGroups",
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribePlacementGroups",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:GetUser",
"iam:GetPolicyVersion",
"iam:GetPolicy",
"iam:List*",
"resource-groups:Get*",
"resource-groups:List*",
"servicequotas:GetServiceQuota",
"servicequotas:ListServiceQuotas",
"sns:ListSubscriptions",
"sns:ListTopics",
"ssm:CreateDocument",
"ssm:DescribeAutomation*",
"ssm:DescribeInstanceInformation",
"ssm:DescribeParameters",
"ssm:GetAutomationExecution",
"ssm:GetCommandInvocation",
"ssm:GetParameter*",
"ssm:GetConnectionStatus",
"ssm:ListCommand*",
"ssm:ListDocument*",
"ssm:ListInstanceAssociations",
"ssm:SendAutomationSignal",
"tag:Get*",
"pricing:GetProducts"
],
"Resource": "*"
},
{
"Sid": "SsmActions4",
"Effect": "Allow",
"Action": [
"ssm:StartAutomationExecution",
"ssm:StopAutomationExecution"
],
"Resource": "arn:aws:ssm:*:*:automation-definition/LaunchWizard-*:*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "SsmActions6",
"Effect": "Allow",
"Action": [
"ssm:CreateOpsMetadata",
"ssm:DeleteOpsMetadata"
],
"Resource": "arn:aws:ssm:*:*:opsmetadata/aws/ssm/LaunchWizard*"
},
{
"Sid": "SsmActions7",
"Effect": "Allow",
"Action": [
"ssm:CreateAssociation",
"ssm:DeleteAssociation"
],
"Resource": [
"arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage",
"arn:aws:ssm:*:*:association/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "SqsActions0",
"Effect": "Allow",
"Action": [
"sqs:TagQueue",
"sqs:GetQueueUrl",
"sqs:AddPermission",
"sqs:ListQueues",
"sqs:DeleteQueue",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "arn:aws:sqs:*:*:LaunchWizard*"
},
{
"Sid": "CloudWatchActions1",
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricAlarm",
"iam:GetInstanceProfile",
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms"
],
"Resource": [
"arn:aws:cloudwatch:*:*:alarm:LaunchWizard*",
"arn:aws:iam::*:instance-profile/LaunchWizard*"
]
},
{
"Sid": "EfsActions0",
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"route53:ListHostedZones",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:DescribeMountTargetSecurityGroups",
"backup:ListBackupPlans"
],
"Resource": "*"
},
{
"Sid": "EfsCreateActions0",
"Effect": "Allow",
"Action": [
"elasticfilesystem:CreateFileSystem",
"elasticfilesystem:CreateMountTarget"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "EfsActions1",
"Effect": "Allow",
"Action": [
"elasticfilesystem:UntagResource",
"elasticfilesystem:TagResource"
],
"Resource": "arn:aws:elasticfilesystem:*:*:file-system/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "S3Actions1",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::launchwizard*",
"arn:aws:s3:::launchwizard*/*",
"arn:aws:s3:::aws-sap-data-provider/config.properties"
]
},
{
"Sid": "ElbActions0",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:DescribeRules",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetGroupAttributes",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTags"
],
"Resource": "*"
},
{
"Sid": "ElbActions1",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2PlacementGroupActions0",
"Effect": "Allow",
"Action": [
"ec2:CreatePlacementGroup",
"ec2:DeletePlacementGroup"
],
"Resource": "arn:aws:ec2:*:*:placement-group/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "Ec2LaunchTemplateActions0",
"Effect": "Allow",
"Action": [
"ec2:CreateLaunchTemplate",
"ec2:DeleteLaunchTemplate",
"ec2:ModifyLaunchTemplate"
],
"Resource": "arn:aws:ec2:*:*:launch-template/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "LambdaActions0",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:PutBucketVersioning",
"s3:DeleteBucket",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction",
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": [
"arn:aws:lambda:*:*:function:LaunchWizard*",
"arn:aws:s3:::launchwizard*"
]
},
{
"Sid": "DynamodbActions0",
"Effect": "Allow",
"Action": [
"dynamodb:CreateTable",
"dynamodb:DescribeTable",
"dynamodb:DeleteTable",
"dynamodb:TagResource",
"dynamodb:UntagResource"
],
"Resource": "arn:aws:dynamodb:*:*:table/LaunchWizard*"
},
{
"Sid": "SecretsManagerActions0",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource",
"secretsmanager:UntagResource",
"secretsmanager:PutResourcePolicy",
"secretsmanager:DeleteResourcePolicy",
"secretsmanager:ListSecretVersionIds",
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:LaunchWizard*"
},
{
"Sid": "SecretsManagerActions1",
"Effect": "Allow",
"Action": [
"secretsmanager:GetRandomPassword",
"secretsmanager:ListSecrets"
],
"Resource": "*"
},
{
"Sid": "SnsActions0",
"Effect": "Allow",
"Action": [
"sns:CreateTopic",
"sns:DeleteTopic",
"sns:Subscribe",
"sns:Unsubscribe"
],
"Resource": "arn:aws:sns:*:*:LaunchWizard*"
},
{
"Sid": "FsxActions0",
"Effect": "Allow",
"Action": [
"fsx:UntagResource",
"fsx:TagResource",
"fsx:DeleteFileSystem",
"fsx:ListTagsForResource"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:ResourceTag/Name": "LaunchWizard*"
}
}
},
{
"Sid": "FsxSvmTagActions0",
"Effect": "Allow",
"Action": [
"fsx:TagResource",
"fsx:UntagResource"
],
"Resource": [
"arn:aws:fsx:*:*:storage-virtual-machine/*/*",
"arn:aws:fsx:*:*:volume/*/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Sid": "FsxActions1",
"Effect": "Allow",
"Action": [
"fsx:CreateFileSystem"
],
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/Name": [
"LaunchWizard*"
]
}
}
},
{
"Sid": "FsxActions2",
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems"
],
"Resource": "*"
},
{
"Sid": "ServiceCatalogActions0",
"Effect": "Allow",
"Action": [
"servicecatalog:CreatePortfolio",
"servicecatalog:DescribePortfolio",
"servicecatalog:CreateConstraint",
"servicecatalog:CreateProduct",
"servicecatalog:AssociatePrincipalWithPortfolio",
"servicecatalog:CreateProvisioningArtifact",
"servicecatalog:TagResource",
"servicecatalog:UntagResource"
],
"Resource": [
"arn:aws:servicecatalog:*:*:*/*",
"arn:aws:catalog:*:*:*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "LogsActions0",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DescribeLogStreams",
"logs:UntagResource",
"logs:TagResource",
"logs:CreateLogGroup",
"logs:DeleteLogStream",
"logs:PutLogEvents",
"logs:GetLogEvents",
"logs:GetLogDelivery",
"logs:GetLogGroupFields",
"logs:GetLogRecord",
"logs:ListLogDeliveries"
],
"Resource": [
"arn:aws:logs:*:*:log-group:LaunchWizard*",
"arn:aws:logs:*:*:log-group:LaunchWizard*:log-stream:*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "LogsActions1",
"Effect": "Allow",
"Action": "logs:DescribeLogGroups",
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "FsxActions3",
"Effect": "Allow",
"Action": [
"fsx:CreateStorageVirtualMachine",
"fsx:CreateVolume"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
},
"StringLike": {
"aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Sid": "FsxActions4",
"Effect": "Allow",
"Action": [
"fsx:DescribeStorageVirtualMachines",
"fsx:DescribeVolumes"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
}
}
},
{
"Sid": "FsxActions5",
"Effect": "Allow",
"Action": [
"fsx:DeleteStorageVirtualMachine",
"fsx:DeleteVolume"
],
"Resource": [
"arn:aws:fsx:*:*:storage-virtual-machine/*/*",
"arn:aws:fsx:*:*:backup/*",
"arn:aws:fsx:*:*:volume/*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "launchwizard.amazonaws.com"
},
"StringLike": {
"aws:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
}
]
},
"VersionId": "v3",
"IsDefaultVersion": true,
"CreateDate": "2026-10-20T16:37:07+00:00"
}
}Version History (6 recorded)
Raw historyv3updated
scope changed, no action added or removed
v2updated
62 actions added
AmazonLaunchWizardFullAccessV2 - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
f56f0cfUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 1, 2023
4716c77