ConsoleFullAccessFromVercel
Last Modified
Oct 8, 2026
October 8, 2026 at 03:02 PM UTC
Version
v5
Total Versions
3
Created
Oct 8, 2026
Actions
236
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 11 permissions management actions across 3 services (s3, s3tables, s3vectors) on any resource, enough to share resources outside the account.
s3:deletebucketpolicys3:putbucketacls3:putbucketpolicys3:putbucketpublicaccessblocks3:putobjectacls3tables:deletetablebucketpolicys3tables:deletetablepolicys3tables:puttablebucketpolicys3tables:puttablepolicys3vectors:deletevectorbucketpolicys3vectors:putvectorbucketpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Can read data in every bucket or table
Reads any object in any S3 bucket; any DynamoDB table. Read-only is not the same as harmless when the data is the asset.
s3:GetObjectdynamodb:Scandynamodb:GetItemUse with caution: Read access to data is still access to data. For people who only need to see configuration, ViewOnlyAccess carries none of these signals.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DSQL",
"Effect": "Allow",
"Action": [
"dsql:GetCluster",
"dsql:ListClusters",
"dsql:ListTagsForResource",
"dsql:UpdateCluster",
"dsql:DbConnectAdmin",
"dsql:DbConnect"
],
"Resource": [
"*"
]
},
{
"Sid": "DynamoDB",
"Effect": "Allow",
"Action": [
"dynamodb:BatchGetItem",
"dynamodb:BatchWriteItem",
"dynamodb:UpdateTimeToLive",
"dynamodb:ConditionCheckItem",
"dynamodb:UntagResource",
"dynamodb:PutItem",
"dynamodb:ListTables",
"dynamodb:DeleteItem",
"dynamodb:Scan",
"dynamodb:ListTagsOfResource",
"dynamodb:Query",
"dynamodb:UpdateItem",
"dynamodb:DescribeTimeToLive",
"dynamodb:TagResource",
"dynamodb:DescribeTable",
"dynamodb:GetItem",
"dynamodb:DescribeLimits",
"dynamodb:UpdateTable",
"dynamodb:GetRecords"
],
"Resource": [
"*"
]
},
{
"Sid": "Aurora",
"Effect": "Allow",
"Action": [
"rds-db:connect",
"rds:Describe*",
"rds:ListTagsForResource",
"rds:RebootDBInstance",
"rds:DeleteDBInstance",
"rds:StartDBInstance",
"rds:ModifyDBInstance",
"rds:ApplyPendingMaintenanceAction",
"rds:StartDBCluster",
"rds:DeleteDBCluster",
"rds:RebootDBCluster",
"rds:CreateDBClusterEndpoint",
"rds:ModifyDBClusterEndpoint",
"rds:ModifyDBCluster",
"rds:DeleteDBClusterEndpoint",
"rds:FailoverDBCluster",
"rds:DeleteDBClusterParameterGroup",
"rds:ModifyDBClusterParameterGroup",
"rds:CopyDBClusterParameterGroup",
"rds:ResetDBClusterParameterGroup",
"rds:CreateDBClusterParameterGroup",
"rds:ResetDBParameterGroup",
"rds:ModifyDBParameterGroup",
"rds:CopyDBParameterGroup",
"rds:DeleteDBParameterGroup",
"rds:CreateDBParameterGroup",
"rds:DeleteDBClusterAutomatedBackup",
"rds:CopyDBClusterSnapshot",
"rds:RestoreDBClusterToPointInTime",
"rds:RestoreDBClusterFromSnapshot",
"rds:CreateDBClusterSnapshot",
"rds:DeleteDBClusterSnapshot",
"ec2:DescribeAvailabilityZones"
],
"Resource": [
"*"
]
},
{
"Sid": "AuroraRestricted",
"Effect": "Allow",
"Action": [
"rds:CreateDBInstance"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"rds:DatabaseEngine": "aurora-postgresql"
}
}
},
{
"Sid": "OpenSearchServerless",
"Effect": "Allow",
"Action": [
"aoss:APIAccessAll",
"aoss:DashboardsAccessAll",
"aoss:BatchGetCollection",
"aoss:BatchGetCollectionGroup",
"aoss:CreateIndex",
"aoss:DeleteIndex",
"aoss:GetAccessPolicy",
"aoss:GetIndex",
"aoss:GetSecurityPolicy",
"aoss:ListAccessPolicies",
"aoss:ListCollectionGroups",
"aoss:ListCollections",
"aoss:ListSecurityPolicies",
"aoss:ListSecurityConfigs",
"aoss:ListTagsForResource",
"aoss:TagResource",
"aoss:UntagResource",
"aoss:AddCollectionToCollectionGroup",
"aoss:UpdateAccessPolicy",
"aoss:UpdateCollection",
"aoss:UpdateCollectionGroup",
"aoss:UpdateIndex",
"aoss:UpdateSecurityPolicy"
],
"Resource": [
"*"
]
},
{
"Sid": "OpenSearchApplications",
"Effect": "Allow",
"Action": [
"es:GetApplication",
"es:UpdateApplication",
"es:ListApplications",
"es:GetDefaultApplicationSetting"
],
"Resource": [
"*"
]
},
{
"Sid": "S3GeneralPurpose",
"Effect": "Allow",
"Action": [
"s3:AbortMultipartUpload",
"s3:CreateBucketMetadataTableConfiguration",
"s3:DeleteBucketPolicy",
"s3:DeleteBucketWebsite",
"s3:DeleteBucketMetadataTableConfiguration",
"s3:DeleteObject",
"s3:DeleteObjectTagging",
"s3:GetBucketAcl",
"s3:GetBucketCORS",
"s3:GetEncryptionConfiguration",
"s3:GetIntelligentTieringConfiguration",
"s3:GetInventoryConfiguration",
"s3:GetAnalyticsConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetBucketLocation",
"s3:GetBucketLogging",
"s3:GetBucketMetadataTableConfiguration",
"s3:GetBucketNotification",
"s3:GetBucketOwnershipControls",
"s3:GetBucketPolicy",
"s3:GetBucketPolicyStatus",
"s3:GetReplicationConfiguration",
"s3:GetBucketRequestPayment",
"s3:GetBucketTagging",
"s3:GetBucketVersioning",
"s3:GetBucketWebsite",
"s3:GetObject",
"s3:GetObjectAcl",
"s3:GetObjectAttributes",
"s3:GetObjectLegalHold",
"s3:GetBucketObjectLockConfiguration",
"s3:GetObjectRetention",
"s3:GetObjectTagging",
"s3:GetBucketPublicAccessBlock",
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:ListBucketVersions",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:PutBucketAcl",
"s3:PutAnalyticsConfiguration",
"s3:PutBucketCORS",
"s3:PutIntelligentTieringConfiguration",
"s3:PutInventoryConfiguration",
"s3:PutLifecycleConfiguration",
"s3:PutBucketLogging",
"s3:PutBucketNotification",
"s3:PutBucketOwnershipControls",
"s3:PutBucketPolicy",
"s3:PutReplicationConfiguration",
"s3:PutBucketRequestPayment",
"s3:PutBucketTagging",
"s3:PutBucketVersioning",
"s3:PutBucketWebsite",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutObjectLegalHold",
"s3:PutBucketObjectLockConfiguration",
"s3:PutObjectRetention",
"s3:PutObjectTagging",
"s3:PutBucketPublicAccessBlock",
"s3:RestoreObject",
"s3:GetBucketAbac",
"s3:PutBucketAbac",
"s3:GetObjectAnnotation",
"s3:PutObjectAnnotation",
"s3:ListObjectAnnotations",
"s3:TagResource",
"s3:UntagResource",
"s3:ListTagsForResource"
],
"Resource": [
"*"
]
},
{
"Sid": "S3Tables",
"Effect": "Allow",
"Action": [
"s3tables:CreateNamespace",
"s3tables:CreateTable",
"s3tables:DeleteNamespace",
"s3tables:DeleteTable",
"s3tables:DeleteTableBucketPolicy",
"s3tables:DeleteTableBucketReplication",
"s3tables:DeleteTablePolicy",
"s3tables:DeleteTableReplication",
"s3tables:GetNamespace",
"s3tables:GetTable",
"s3tables:GetTableBucket",
"s3tables:GetTableBucketEncryption",
"s3tables:GetTableBucketMaintenanceConfiguration",
"s3tables:GetTableBucketPolicy",
"s3tables:GetTableBucketReplication",
"s3tables:GetTableBucketStorageClass",
"s3tables:GetTableData",
"s3tables:GetTableEncryption",
"s3tables:GetTableMaintenanceConfiguration",
"s3tables:GetTableMaintenanceJobStatus",
"s3tables:GetTableMetadataLocation",
"s3tables:GetTablePolicy",
"s3tables:GetTableRecordExpirationConfiguration",
"s3tables:GetTableRecordExpirationJobStatus",
"s3tables:GetTableReplication",
"s3tables:GetTableReplicationStatus",
"s3tables:GetTableStorageClass",
"s3tables:ListNamespaces",
"s3tables:ListTables",
"s3tables:ListTableBuckets",
"s3tables:ListTagsForResource",
"s3tables:PutTableBucketMaintenanceConfiguration",
"s3tables:PutTableBucketPolicy",
"s3tables:PutTableBucketReplication",
"s3tables:PutTableBucketStorageClass",
"s3tables:PutTableData",
"s3tables:PutTableMaintenanceConfiguration",
"s3tables:PutTablePolicy",
"s3tables:PutTableRecordExpirationConfiguration",
"s3tables:PutTableReplication",
"s3tables:RenameTable",
"s3tables:TagResource",
"s3tables:UntagResource",
"s3tables:UpdateTableMetadataLocation"
],
"Resource": [
"*"
]
},
{
"Sid": "S3TablesReplicationPassRole",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "replication.s3tables.amazonaws.com"
}
}
},
{
"Sid": "S3Vectors",
"Effect": "Allow",
"Action": [
"s3vectors:CreateIndex",
"s3vectors:DeleteIndex",
"s3vectors:DeleteVectorBucketPolicy",
"s3vectors:DeleteVectors",
"s3vectors:GetIndex",
"s3vectors:GetVectorBucket",
"s3vectors:GetVectorBucketPolicy",
"s3vectors:GetVectors",
"s3vectors:ListIndexes",
"s3vectors:ListVectorBuckets",
"s3vectors:ListVectors",
"s3vectors:ListTagsForResource",
"s3vectors:PutVectorBucketPolicy",
"s3vectors:PutVectors",
"s3vectors:QueryVectors",
"s3vectors:TagResource",
"s3vectors:UntagResource"
],
"Resource": [
"*"
]
},
{
"Sid": "Observability",
"Effect": "Allow",
"Action": [
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics",
"cloudwatch:PutMetricAlarm",
"logs:DescribeLogStreams",
"logs:GetLogEvents",
"tag:GetTagKeys",
"tag:GetTagValues"
],
"Resource": [
"*"
]
},
{
"Sid": "ApplicationAutoscalingIntegration",
"Effect": "Allow",
"Action": [
"application-autoscaling:DeleteScalingPolicy",
"application-autoscaling:DeregisterScalableTarget",
"application-autoscaling:PutScalingPolicy",
"application-autoscaling:RegisterScalableTarget"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"application-autoscaling:service-namespace": "dynamodb"
}
}
},
{
"Sid": "ApplicationAutoscalingDescribeActions",
"Effect": "Allow",
"Action": [
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingActivities",
"application-autoscaling:DescribeScalingPolicies"
],
"Resource": "*"
},
{
"Sid": "ViewFreeTierState",
"Effect": "Allow",
"Action": [
"freetier:GetAccountPlanState"
],
"Resource": "*"
}
]
},
"VersionId": "v5",
"IsDefaultVersion": true,
"CreateDate": "2026-10-08T14:27:08+00:00"
}
}Version History (6 recorded)
Raw historyv5updated
132 actions added
25 never-before-seen actions: s3:CreateBucketMetadataTableConfiguration, s3:DeleteBucketMetadataTableConfiguration, s3:PutAnalyticsConfiguration, s3:PutBucketAbac, s3:PutBucketRequestPayment, s3:PutIntelligentTieringConfiguration, s3:PutObjectAnnotation, s3:PutObjectLegalHold, s3tables:DeleteTableBucketPolicy, s3tables:DeleteTableBucketReplication, s3tables:DeleteTablePolicy, s3tables:DeleteTableReplication, s3tables:PutTableBucketMaintenanceConfiguration, s3tables:PutTableBucketReplication, s3tables:PutTableBucketStorageClass, s3tables:PutTableMaintenanceConfiguration, s3tables:PutTablePolicy, s3tables:PutTableRecordExpirationConfiguration, s3tables:PutTableReplication, s3tables:TagResource, s3tables:UntagResource, s3vectors:DeleteVectorBucketPolicy, s3vectors:PutVectorBucketPolicy, s3vectors:TagResource, s3vectors:UntagResource
13 permissions management, incl. iam:PassRole: iam:PassRole, s3:DeleteBucketPolicy, s3:PutBucketAcl, s3:PutBucketOwnershipControls, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock, s3:PutObjectAcl, s3tables:DeleteTableBucketPolicy, s3tables:DeleteTablePolicy, s3tables:PutTableBucketPolicy, s3tables:PutTablePolicy, s3vectors:DeleteVectorBucketPolicy, s3vectors:PutVectorBucketPolicy
v4updated
27 actions added
v3updated
scope changed, no action added or removed
ConsoleFullAccessFromVercel - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
44c396fConsoleFullAccessFromVercel - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
dfd1494ConsoleFullAccessFromVercel - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Dec 11, 2025
8bc5bf9