Deprecated
Removed from AWS on 2021-04-02 - Active for 10 months
AmazonLaunchWizardFullaccess
Last Modified
Jun 3, 2020
June 3, 2020 at 08:48 PM UTC
Version
v5
Total Versions
5
Created
Jun 3, 2020
Actions
198
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can read secrets
Reads Parameter Store values, SecureString included where the KMS key allows it, on any resource with no condition.
ssm:GetParameter (via ssm:GetParameter*)ssm:GetParameters (via ssm:GetParameter*)ssm:GetParametersByPath (via ssm:GetParameter*)Use with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 4 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*, arn:aws:iam::*:instance-profile/LaunchWizard*
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*, arn:aws:iam::*:instance-profile/LaunchWizard*
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*, arn:aws:iam::*:instance-profile/LaunchWizard*
- lambda:CreateFunction: on arn:aws:lambda:*:*:function:LaunchWizard*, arn:aws:s3:::launchwizard*
- lambda:InvokeFunction: on arn:aws:lambda:*:*:function:LaunchWizard*, arn:aws:s3:::launchwizard*
- iam:PassRole: on arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*, arn:aws:iam::*:instance-profile/LaunchWizard*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- ec2:StopInstances: condition ec2:ResourceTag/aws:cloudformation:stack-id
- ssm:SendCommand: condition aws:TagKeys
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can rewrite resource policies and sharing
Grants 1 permissions management action across 1 service (ec2) on any resource, enough to share resources outside the account.
ec2:deletenetworkinterfacepermissionUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Can read data in every bucket or table
Reads any object in any S3 bucket. Read-only is not the same as harmless when the data is the asset.
s3:GetObjectUse with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.
- Medium
Full access to 2 services on every resource
Uses applicationinsights:*, launchwizard:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
applicationinsights:*launchwizard:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "applicationinsights:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "resource-groups:List*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets",
"route53:GetChange",
"route53:ListResourceRecordSets",
"route53:ListHostedZones",
"route53:ListHostedZonesByName"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBuckets",
"s3:ListObjects",
"s3:ListObjectsV2"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Get*",
"cloudwatch:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress",
"ec2:AllocateHosts",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreateNetworkInterface",
"ec2:CreateVolume",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:CreateInternetGateway",
"ec2:CreateKeyPair",
"ec2:CreateNatGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:RunInstances",
"ec2:StartInstances",
"cloudformation:DescribeStack*",
"cloudformation:Get*",
"cloudformation:ListStacks",
"cloudformation:SignalResource",
"ec2:ModifyInstanceAttribute",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVolumeAttribute",
"ec2:ModifyVpcAttribute",
"ec2:AssociateDhcpOptions",
"ec2:AssociateSubnetCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVolume"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:StopInstances",
"ec2:TerminateInstances"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:DeleteSnapshot"
],
"Resource": "*",
"Condition": {
"Null": {
"ec2:ResourceTag/LaunchWizardResourceGroupID": "false"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteKeyPair",
"ec2:DeleteNatGateway",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DeleteVpc",
"ec2:DetachInternetGateway",
"ec2:DetachVolume",
"ec2:GetConsoleOutput",
"ec2:GetPasswordData",
"ec2:ReleaseAddress",
"ec2:ReplaceRoute",
"ec2:ReplaceRouteTableAssociation",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"elasticfilesystem:DeleteFileSystem",
"elasticfilesystem:DeleteMountTarget",
"ec2:DisassociateIamInstanceProfile",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
"cloudformation:DeleteStack"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:PassRole",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonEC2RoleForLaunchWizard*",
"arn:aws:iam::*:instance-profile/LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonLambdaRoleForLaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:AttachInstances",
"autoscaling:CreateAutoScalingGroup",
"autoscaling:CreateLaunchConfiguration",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:DeleteLaunchConfiguration",
"autoscaling:UpdateAutoScalingGroup",
"logs:CreateLogStream",
"logs:DeleteLogGroup",
"logs:DeleteLogStream",
"logs:DescribeLog*",
"logs:PutLogEvents",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"sns:ListSubscriptionsByTopic",
"sns:Publish",
"ssm:DeleteDocument",
"ssm:DeleteParameter*",
"ssm:DescribeDocument*",
"ssm:GetDocument",
"ssm:PutParameter"
],
"Resource": [
"arn:aws:resource-groups:*:*:group/LaunchWizard*",
"arn:aws:sns:*:*:*",
"arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/LaunchWizard*",
"arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/LaunchWizard*",
"arn:aws:ssm:*:*:parameter/LaunchWizard*",
"arn:aws:ssm:*:*:document/LaunchWizard*",
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "LaunchWizard*"
}
}
},
{
"Effect": "Allow",
"Action": [
"logs:DeleteLogStream",
"logs:GetLogEvents",
"logs:PutLogEvents",
"ssm:AddTagsToResource",
"ssm:DescribeDocument",
"ssm:GetDocument",
"ssm:ListTagsForResource",
"ssm:RemoveTagsFromResource"
],
"Resource": [
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:LaunchWizard*",
"arn:aws:ssm:*:*:parameter/LaunchWizard*",
"arn:aws:ssm:*:*:document/LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"autoscaling:Describe*",
"cloudformation:DescribeAccountLimits",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:List*",
"ds:AddIpRoutes",
"ds:CreateComputer",
"ds:CreateMicrosoftAD",
"ds:DeleteDirectory",
"ds:Describe*",
"ds:ListAuthorizedApplications",
"ec2:AssociateRouteTable",
"ec2:AssociateVpcCidrBlock",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSubnet",
"ec2:Describe*",
"ec2:DetachNetworkInterface",
"ec2:DisassociateAddress",
"ec2:DisassociateVpcCidrBlock",
"ec2:GetLaunchTemplateData",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifyVolume",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:List*",
"logs:CreateLogGroup",
"logs:GetLogDelivery",
"logs:GetLogRecord",
"logs:ListLogDeliveries",
"resource-groups:Get*",
"resource-groups:List*",
"servicequotas:GetServiceQuota",
"servicequotas:ListServiceQuotas",
"sns:ListSubscriptions",
"sns:ListTopics",
"ssm:CreateDocument",
"ssm:DescribeAutomation*",
"ssm:DescribeInstanceInformation",
"ssm:DescribeParameters",
"ssm:GetAutomationExecution",
"ssm:GetCommandInvocation",
"ssm:GetParameter*",
"ssm:ListCommand*",
"ssm:ListDocument*",
"ssm:ListInstanceAssociations",
"ssm:SendAutomationSignal",
"ssm:StartAutomationExecution",
"ssm:StopAutomationExecution",
"tag:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/LaunchWizard-*/*"
}
}
},
{
"Effect": "Allow",
"Action": "logs:GetLog*",
"Resource": [
"arn:aws:logs:*:*:log-group:*:*:*",
"arn:aws:logs:::log-group:LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "arn:aws:cloudformation:::stack/LaunchWizard*/"
},
{
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling*",
"arn:aws:iam::*:role/aws-service-role/application-insights.amazonaws.com/AWSServiceRoleForApplicationInsights"
]
},
{
"Effect": "Allow",
"Action": "launchwizard:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sqs:TagQueue",
"sqs:GetQueueUrl",
"sqs:AddPermission",
"sqs:ListQueues",
"sqs:DeleteQueue",
"sqs:GetQueueAttributes",
"sqs:ListQueueTags",
"sqs:CreateQueue",
"sqs:SetQueueAttributes"
],
"Resource": "arn:aws:sqs:*:*:LaunchWizard*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricAlarm",
"iam:GetInstanceProfile",
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms"
],
"Resource": [
"arn:aws:cloudwatch:*:*:alarm:LaunchWizard*",
"arn:aws:iam::*:instance-profile/LaunchWizard*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"cloudformation:CreateStack",
"route53:ListHostedZones",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress",
"elasticfilesystem:DescribeFileSystems",
"elasticfilesystem:CreateFileSystem",
"elasticfilesystem:CreateMountTarget",
"elasticfilesystem:DescribeMountTargets",
"elasticfilesystem:DescribeMountTargetSecurityGroups"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "cloudformation:TagResource",
"Resource": "*",
"Condition": {
"ForAllValues:StringLike": {
"aws:TagKeys": "LaunchWizard*"
}
}
},
{
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:PutBucketVersioning",
"s3:DeleteBucket",
"lambda:CreateFunction",
"lambda:DeleteFunction",
"lambda:GetFunction",
"lambda:GetFunctionConfiguration",
"lambda:InvokeFunction"
],
"Resource": [
"arn:aws:lambda:*:*:function:LaunchWizard*",
"arn:aws:s3:::launchwizard*"
]
}
]
},
"VersionId": "v5",
"IsDefaultVersion": true,
"CreateDate": "2020-06-03T16:57:16Z"
}
}Version History (5 recorded)
Raw historyUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 3, 2020
25fe43dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 7, 2020
ab7133aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 5, 2020
88a96e6Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 25, 2019
282c8fdUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 13, 2019
68f866e