AmazonRDSCustomPreviewServiceRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:28 PM UTC
Version
v15
Total Versions
12
Created
Feb 12, 2026
Actions
116
Risk
HighAn unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- High
Can take over existing resources that run as another role
Grants every action of 1 documented escalation path on any resource with no condition.
Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/AWSRDSCustom*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 11599 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ecc1",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeRegions",
"ec2:DescribeSnapshots",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeVolumes",
"ec2:DescribeInstanceStatus",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeImages",
"ec2:DescribeVpcs",
"ec2:RegisterImage",
"ec2:DeregisterImage",
"ec2:DescribeTags",
"ec2:DescribeSecurityGroups",
"ec2:DescribeVolumesModifications",
"ec2:DescribeSubnets",
"ec2:DescribeVpcAttribute",
"ec2:SearchTransitGatewayMulticastGroups",
"ec2:GetTransitGatewayMulticastDomainAssociations",
"ec2:DescribeTransitGatewayMulticastDomains",
"ec2:DescribeTransitGateways",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribePlacementGroups",
"ec2:DescribeRouteTables"
],
"Resource": [
"*"
]
},
{
"Sid": "ecc2",
"Effect": "Allow",
"Action": [
"ec2:DisassociateIamInstanceProfile",
"ec2:AssociateIamInstanceProfile",
"ec2:ReplaceIamInstanceProfileAssociation",
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ecc1scoping",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress"
],
"Resource": [
"*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ecc1scoping2",
"Effect": "Allow",
"Action": [
"ec2:AssociateAddress",
"ec2:DisassociateAddress",
"ec2:ReleaseAddress"
],
"Resource": [
"*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ecc1scoping3",
"Effect": "Allow",
"Action": [
"ec2:AssignPrivateIpAddresses"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccRunInstances1",
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccRunInstances2",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*::image/*",
"arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*",
"arn:aws:ec2:*:*:placement-group/*"
]
},
{
"Sid": "eccRunInstances3",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*::snapshot/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle-rac",
"custom-oracle"
]
}
}
},
{
"Sid": "RequireImdsV2",
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringNotEquals": {
"ec2:MetadataHttpTokens": "required"
},
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccRunInstances3keyPair1",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DeleteKeyPair"
],
"Resource": [
"arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*",
"arn:aws:ec2:*:*:key-pair/preview-rds-custom!*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccKeyPair2",
"Effect": "Allow",
"Action": [
"ec2:CreateKeyPair"
],
"Resource": [
"arn:aws:ec2:*:*:key-pair/do-not-delete-rds-custom-*",
"arn:aws:ec2:*:*:key-pair/preview-rds-custom!*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccNetworkInterface1",
"Effect": "Allow",
"Action": "ec2:CreateNetworkInterface",
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccNetworkInterface2",
"Effect": "Allow",
"Action": "ec2:CreateNetworkInterface",
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
]
},
{
"Sid": "eccNetworkInterface3",
"Effect": "Allow",
"Action": "ec2:DeleteNetworkInterface",
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccCreateTag1",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccCreateTag2",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
],
"ec2:CreateAction": [
"CreateKeyPair",
"RunInstances",
"CreateNetworkInterface",
"CreateVolume",
"CreateSnapshots",
"CopySnapshot",
"AllocateAddress"
]
}
}
},
{
"Sid": "eccVolume1",
"Effect": "Allow",
"Action": [
"ec2:DetachVolume",
"ec2:AttachVolume"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccVolume2",
"Effect": "Allow",
"Action": "ec2:CreateVolume",
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccVolume3",
"Effect": "Allow",
"Action": [
"ec2:ModifyVolumeAttribute",
"ec2:DeleteVolume",
"ec2:ModifyVolume"
],
"Resource": "arn:aws:ec2:*:*:volume/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccVolume4snapshot1",
"Effect": "Allow",
"Action": [
"ec2:CreateVolume",
"ec2:DeleteSnapshot"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccSnapshot2",
"Effect": "Allow",
"Action": [
"ec2:CreateSnapshots"
],
"Resource": "arn:aws:ec2:*::snapshot/*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccSnapshot3",
"Effect": "Allow",
"Action": "ec2:CreateSnapshots",
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eccSnapshotCopySource",
"Effect": "Allow",
"Action": [
"ec2:CopySnapshot"
],
"Resource": "arn:aws:ec2:*::snapshot/snap-*"
},
{
"Sid": "eccSnapshotCopyDestination",
"Effect": "Allow",
"Action": [
"ec2:CopySnapshot"
],
"Resource": [
"arn:aws:ec2:*::snapshot/${*}"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "iam1",
"Effect": "Allow",
"Action": [
"iam:ListInstanceProfiles",
"iam:GetInstanceProfile",
"iam:GetRole",
"iam:ListRolePolicies",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:GetPolicy",
"iam:GetPolicyVersion"
],
"Resource": "*"
},
{
"Sid": "iam2",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/AWSRDSCustom*",
"Condition": {
"StringLike": {
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Sid": "cloudtrail1",
"Effect": "Allow",
"Action": [
"cloudtrail:GetTrailStatus"
],
"Resource": "arn:aws:cloudtrail:*:*:trail/do-not-delete-rds-custom-*"
},
{
"Sid": "cw1",
"Effect": "Allow",
"Action": [
"cloudwatch:EnableAlarmActions",
"cloudwatch:DeleteAlarms"
],
"Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "cw2",
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricAlarm",
"cloudwatch:TagResource"
],
"Resource": "arn:aws:cloudwatch:*:*:alarm:do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "cw3",
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms"
],
"Resource": "arn:aws:cloudwatch:*:*:alarm:*"
},
{
"Sid": "ssm1",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": "arn:aws:ssm:*:*:document/*"
},
{
"Sid": "ssm2",
"Effect": "Allow",
"Action": "ssm:SendCommand",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ssm3",
"Effect": "Allow",
"Action": [
"ssm:GetCommandInvocation",
"ssm:GetConnectionStatus",
"ssm:DescribeInstanceInformation"
],
"Resource": "*"
},
{
"Sid": "ssm4",
"Effect": "Allow",
"Action": [
"ssm:PutParameter",
"ssm:AddTagsToResource"
],
"Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "ssm5",
"Effect": "Allow",
"Action": [
"ssm:DeleteParameter"
],
"Resource": "arn:aws:ssm:*:*:parameter/rds/custom-oracle-rac/*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eb1",
"Effect": "Allow",
"Action": [
"events:PutRule",
"events:TagResource"
],
"Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eb2",
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:DescribeRule",
"events:EnableRule",
"events:ListTargetsByRule",
"events:DeleteRule",
"events:RemoveTargets",
"events:DisableRule"
],
"Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "eb3",
"Effect": "Allow",
"Action": [
"events:PutRule"
],
"Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"events:ManagedBy": [
"custom.rds-preview.amazonaws.com"
]
}
}
},
{
"Sid": "eb4",
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:EnableRule",
"events:DeleteRule",
"events:RemoveTargets",
"events:DisableRule"
],
"Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"events:ManagedBy": [
"custom.rds-preview.amazonaws.com"
]
}
}
},
{
"Sid": "eb5",
"Effect": "Allow",
"Action": [
"events:DescribeRule",
"events:ListTargetsByRule"
],
"Resource": "arn:aws:events:*:*:rule/do-not-delete-rds-custom-*"
},
{
"Sid": "secretmanager1",
"Effect": "Allow",
"Action": [
"secretsmanager:TagResource",
"secretsmanager:CreateSecret"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*",
"arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*"
],
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "secretmanager2",
"Effect": "Allow",
"Action": [
"secretsmanager:TagResource",
"secretsmanager:DescribeSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:PutSecretValue",
"secretsmanager:RestoreSecret"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*",
"arn:aws:secretsmanager:*:*:secret:preview-rds-custom!*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle",
"custom-sqlserver",
"custom-oracle-rac"
]
}
}
},
{
"Sid": "secretmanager3",
"Effect": "Allow",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "servicequota1",
"Effect": "Allow",
"Action": [
"servicequotas:GetServiceQuota"
],
"Resource": "*"
},
{
"Sid": "sqs1",
"Effect": "Allow",
"Action": [
"sqs:CreateQueue",
"sqs:TagQueue"
],
"Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:RequestTag/AWSRDSCustom": [
"custom-oracle"
]
}
}
},
{
"Sid": "sqs2",
"Effect": "Allow",
"Action": [
"sqs:GetQueueAttributes",
"sqs:SendMessage",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:DeleteQueue"
],
"Resource": "arn:aws:sqs:*:*:do-not-delete-rds-custom-*",
"Condition": {
"StringLike": {
"aws:ResourceTag/AWSRDSCustom": [
"custom-oracle"
]
}
}
}
]
},
"VersionId": "v15",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T17:58:02+00:00"
}
}Version History (17 recorded)
Raw historyAmazonRDSCustomPreviewServiceRolePolicy - Policy Version v15
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
e14963fAmazonRDSCustomPreviewServiceRolePolicy - Policy Version v15
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
7d67b39AmazonRDSCustomPreviewServiceRolePolicy - Policy Version v12
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
ed9f513AmazonRDSCustomPreviewServiceRolePolicy - Policy Version v9
No recorded action delta - this version predates the change index. View the raw diff.
Aug 8, 2025
73252beAmazonRDSCustomPreviewServiceRolePolicy - Policy Version v8
No recorded action delta - this version predates the change index. View the raw diff.
Aug 7, 2025
4f0f9afUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 25, 2025
17e8d12Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 7, 2025
b313eecUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 20, 2023
999b854Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 23, 2023
5040e9aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 26, 2023
64c78b8Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 26, 2023
71e1633Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 15, 2023
fa0d20aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 8, 2022
8fee3beUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 8, 2022
9095030Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 8, 2021
e9e93c1