AmazonSecurityLakeAdministrator
Last Modified
Mar 12, 2026
March 12, 2026 at 09:28 PM UTC
Version
v2
Total Versions
3
Created
Feb 23, 2024
Actions
88
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can grant itself more permissions
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PutRolePolicy: condition aws:CalledVia, iam:PermissionsBoundary, on arn:aws:iam::*:role/AmazonSecurityLake*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:AssociatedResourceARN, iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager, arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2
- lambda:CreateFunction: condition aws:CalledVia, on arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*, arn:aws:lambda:*:*:function:AmazonSecurityLake*
- lambda:CreateEventSourceMapping: condition aws:CalledVia
- iam:PassRole: condition iam:AssociatedResourceARN, iam:PassedToService, on arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager, arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2
- lambda:CreateFunction: condition aws:CalledVia, on arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*, arn:aws:lambda:*:*:function:AmazonSecurityLake*
- lambda:AddPermission: condition aws:CalledVia, lambda:Principal, on arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*, arn:aws:lambda:*:*:function:AmazonSecurityLake*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Full securitylake access on every resource
Uses securitylake:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
securitylake:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
- Medium
Flagged by AWS IAM Access Analyzer
AWS's own policy validation raises 8 security warnings: STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS.
- Use the operator type ARN instead of operator string for the condition key ram:ResourceArn.
- Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN.
- Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN.
- Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN.
- Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN.
Use with caution: Read AWS's finding and the documentation it links to.
IAM Access Analyzer (8)
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key ram:ResourceArn. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
- Security warning / STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS
Use the operator type ARN instead of operator string for the condition key iam:AssociatedResourceARN. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowActionsWithAnyResource",
"Effect": "Allow",
"Action": [
"securitylake:*",
"organizations:DescribeOrganization",
"organizations:ListDelegatedServicesForAccount",
"organizations:ListAccounts",
"iam:ListRoles",
"ram:GetResourceShareAssociations"
],
"Resource": "*"
},
{
"Sid": "AllowActionsWithAnyResourceViaSecurityLake",
"Effect": "Allow",
"Action": [
"glue:CreateCrawler",
"glue:StopCrawlerSchedule",
"lambda:CreateEventSourceMapping",
"lakeformation:GrantPermissions",
"lakeformation:ListPermissions",
"lakeformation:RegisterResource",
"lakeformation:RevokePermissions",
"lakeformation:GetDatalakeSettings",
"events:ListConnections",
"events:ListApiDestinations",
"iam:GetRole",
"iam:ListAttachedRolePolicies",
"kms:DescribeKey"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowManagingSecurityLakeS3Buckets",
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:PutBucketPolicy",
"s3:PutBucketPublicAccessBlock",
"s3:PutBucketNotification",
"s3:PutBucketTagging",
"s3:PutEncryptionConfiguration",
"s3:PutBucketVersioning",
"s3:PutReplicationConfiguration",
"s3:PutLifecycleConfiguration",
"s3:ListBucket",
"s3:PutObject",
"s3:GetBucketNotification"
],
"Resource": "arn:aws:s3:::aws-security-data-lake*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowLambdaCreateFunction",
"Effect": "Allow",
"Action": [
"lambda:CreateFunction"
],
"Resource": [
"arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*",
"arn:aws:lambda:*:*:function:AmazonSecurityLake*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowLambdaAddPermission",
"Effect": "Allow",
"Action": [
"lambda:AddPermission"
],
"Resource": [
"arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*",
"arn:aws:lambda:*:*:function:AmazonSecurityLake*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
},
"StringEquals": {
"lambda:Principal": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowGlueActions",
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:CreateTable",
"glue:GetTable"
],
"Resource": [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:database/amazon_security_lake_glue_db*",
"arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowEventBridgeActions",
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule",
"events:DescribeRule",
"events:CreateApiDestination",
"events:CreateConnection",
"events:UpdateConnection",
"events:UpdateApiDestination",
"events:DeleteConnection",
"events:DeleteApiDestination",
"events:ListTargetsByRule",
"events:RemoveTargets",
"events:DeleteRule"
],
"Resource": [
"arn:aws:events:*:*:rule/AmazonSecurityLake*",
"arn:aws:events:*:*:rule/SecurityLake*",
"arn:aws:events:*:*:api-destination/AmazonSecurityLake*",
"arn:aws:events:*:*:connection/AmazonSecurityLake*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowSQSActions",
"Effect": "Allow",
"Action": [
"sqs:CreateQueue",
"sqs:SetQueueAttributes",
"sqs:GetQueueURL",
"sqs:AddPermission",
"sqs:GetQueueAttributes",
"sqs:DeleteQueue"
],
"Resource": [
"arn:aws:sqs:*:*:SecurityLake*",
"arn:aws:sqs:*:*:AmazonSecurityLake*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowKmsCmkGrantForSecurityLake",
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
},
"StringLike": {
"kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::aws-security-data-lake*"
},
"ForAllValues:StringEquals": {
"kms:GrantOperations": [
"GenerateDataKey",
"RetireGrant",
"Decrypt"
]
}
}
},
{
"Sid": "AllowEnablingQueryBasedSubscribers",
"Effect": "Allow",
"Action": [
"ram:CreateResourceShare",
"ram:AssociateResourceShare"
],
"Resource": "*",
"Condition": {
"StringLikeIfExists": {
"ram:ResourceArn": [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:database/amazon_security_lake_glue_db*",
"arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowConfiguringQueryBasedSubscribers",
"Effect": "Allow",
"Action": [
"ram:UpdateResourceShare",
"ram:GetResourceShares",
"ram:DisassociateResourceShare",
"ram:DeleteResourceShare"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ram:ResourceShareName": "LakeFormation*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowConfiguringCredentialsForSubscriberNotification",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:PutSecretValue"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:events!connection/AmazonSecurityLake-*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowPassRoleForUpdatingGluePartitionsSecLakeArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager",
"arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default"
}
}
},
{
"Sid": "AllowPassRoleForUpdatingGluePartitionsLambdaArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager",
"arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": [
"arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*",
"arn:aws:lambda:*:*:function:AmazonSecurityLake*"
]
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowPassRoleForCrossRegionReplicationSecLakeArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole",
"Condition": {
"StringEquals": {
"iam:PassedToService": "s3.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default"
}
}
},
{
"Sid": "AllowPassRoleForCrossRegionReplicationS3Arn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole",
"Condition": {
"StringEquals": {
"iam:PassedToService": "s3.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:s3:::aws-security-data-lake*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowPassRoleForCustomSourceCrawlerSecLakeArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "glue.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:data-lake/default"
}
}
},
{
"Sid": "AllowPassRoleForCustomSourceCrawlerGlueArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "glue.amazonaws.com"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowPassRoleForSubscriberNotificationSecLakeArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge",
"Condition": {
"StringEquals": {
"iam:PassedToService": "events.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:securitylake:*:*:subscriber/*"
}
}
},
{
"Sid": "AllowPassRoleForSubscriberNotificationEventsArn",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge",
"Condition": {
"StringEquals": {
"iam:PassedToService": "events.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceARN": "arn:aws:events:*:*:rule/AmazonSecurityLake*"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowOnboardingToSecurityLakeDependencies",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": [
"arn:aws:iam::*:role/aws-service-role/securitylake.amazonaws.com/AWSServiceRoleForSecurityLake",
"arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess",
"arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations"
],
"Condition": {
"StringLike": {
"iam:AWSServiceName": [
"securitylake.amazonaws.com",
"lakeformation.amazonaws.com",
"apidestinations.events.amazonaws.com"
]
}
}
},
{
"Sid": "AllowRolePolicyActionsforSubscibersandSources",
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:PutRolePolicy",
"iam:DeleteRolePolicy"
],
"Resource": "arn:aws:iam::*:role/AmazonSecurityLake*",
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowRegisterS3LocationInLakeFormation",
"Effect": "Allow",
"Action": [
"iam:PutRolePolicy",
"iam:GetRolePolicy"
],
"Resource": "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "AllowIAMActionsByResource",
"Effect": "Allow",
"Action": [
"iam:ListRolePolicies",
"iam:DeleteRole"
],
"Resource": "arn:aws:iam::*:role/AmazonSecurityLake*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": "securitylake.amazonaws.com"
}
}
},
{
"Sid": "S3ReadAccessToSecurityLakes",
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": "arn:aws:s3:::aws-security-data-lake-*"
},
{
"Sid": "S3ReadAccessToSecurityLakeMetastoreObject",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::security-lake-meta-store-manager-*"
},
{
"Sid": "S3ResourcelessReadOnly",
"Effect": "Allow",
"Action": [
"s3:GetAccountPublicAccessBlock",
"s3:ListAccessPoints",
"s3:ListAllMyBuckets"
],
"Resource": "*"
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2024-02-23T16:01:57+00:00"
}
}Version History (6 recorded)
Raw historyAmazonSecurityLakeAdministrator - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
a04d546Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 23, 2024
097d765Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 23, 2024
11d9413Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 30, 2023
f4c17ca