FMSServiceRolePolicy
Last Modified
Apr 6, 2026
April 6, 2026 at 10:03 PM UTC
Version
v37
Total Versions
34
Created
Apr 6, 2026
Actions
206
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 5 permissions management actions across 3 services (route53resolver, waf-regional, waf) on any resource, enough to share resources outside the account.
route53resolver:putfirewallrulegrouppolicywaf-regional:deletepermissionpolicywaf-regional:putpermissionpolicywaf:deletepermissionpolicywaf:putpermissionpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
IAM Access Analyzer (2)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 13701 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
- Suggestion / EQUIVALENT_TO_NULL_FALSE
We recommend replacing the key aws:ResourceTag/FMManaged in the condition block of StringLike with {aws:ResourceTag/FMManaged: false} to ensure better enforcement of the condition. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "WafGeneral",
"Effect": "Allow",
"Action": [
"waf:UpdateWebACL",
"waf:DeleteWebACL",
"waf:GetWebACL",
"waf:GetRuleGroup",
"waf:ListSubscribedRuleGroups",
"waf-regional:UpdateWebACL",
"waf-regional:DeleteWebACL",
"waf-regional:GetWebACL",
"waf-regional:GetRuleGroup",
"waf-regional:ListSubscribedRuleGroups",
"waf-regional:ListResourcesForWebACL",
"waf-regional:AssociateWebACL",
"waf-regional:DisassociateWebACL",
"elasticloadbalancing:SetWebACL",
"apigateway:SetWebACL",
"elasticloadbalancing:SetSecurityGroups",
"waf:ListTagsForResource",
"waf-regional:ListTagsForResource"
],
"Resource": [
"arn:aws:waf:*:*:webacl/*",
"arn:aws:waf-regional:*:*:webacl/*",
"arn:aws:waf:*:*:rulegroup/*",
"arn:aws:waf-regional:*:*:rulegroup/*",
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*",
"arn:aws:apigateway:*::/restapis/*/stages/*"
]
},
{
"Sid": "Wafv2Logging",
"Effect": "Allow",
"Action": [
"wafv2:PutLoggingConfiguration",
"wafv2:GetLoggingConfiguration",
"wafv2:ListLoggingConfigurations",
"wafv2:DeleteLoggingConfiguration"
],
"Resource": [
"arn:aws:wafv2:*:*:regional/webacl/*",
"arn:aws:wafv2:*:*:global/webacl/*"
]
},
{
"Sid": "WafWebaclCreation",
"Effect": "Allow",
"Action": [
"waf:CreateWebACL",
"waf-regional:CreateWebACL",
"waf:GetChangeToken",
"waf-regional:GetChangeToken",
"waf-regional:GetWebACLForResource"
],
"Resource": [
"arn:aws:waf:*:*:*",
"arn:aws:waf-regional:*:*:*"
]
},
{
"Sid": "ElbGeneral",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:ApplySecurityGroupsToLoadBalancer",
"elasticloadbalancing:DescribeTags"
],
"Resource": "*"
},
{
"Sid": "WafPermissionPolicy",
"Effect": "Allow",
"Action": [
"waf:PutPermissionPolicy",
"waf:GetPermissionPolicy",
"waf:DeletePermissionPolicy",
"waf-regional:PutPermissionPolicy",
"waf-regional:GetPermissionPolicy",
"waf-regional:DeletePermissionPolicy"
],
"Resource": [
"arn:aws:waf:*:*:webacl/*",
"arn:aws:waf:*:*:rulegroup/*",
"arn:aws:waf-regional:*:*:webacl/*",
"arn:aws:waf-regional:*:*:rulegroup/*"
]
},
{
"Sid": "CloudfrontGeneral",
"Effect": "Allow",
"Action": [
"cloudfront:GetDistribution",
"cloudfront:UpdateDistribution",
"cloudfront:ListDistributionsByWebACLId",
"cloudfront:ListDistributions",
"cloudfront:ListTagsForResource",
"cloudfront:AssociateDistributionWebACL",
"cloudfront:DisassociateDistributionWebACL"
],
"Resource": "*"
},
{
"Sid": "CloudfrontVpcOriginAccess",
"Effect": "Allow",
"Action": [
"cloudfront:GetVpcOrigin"
],
"Resource": "arn:aws:cloudfront::*:vpcorigin/*"
},
{
"Sid": "ConfigScoped",
"Effect": "Allow",
"Action": [
"config:DeleteConfigRule",
"config:GetComplianceDetailsByConfigRule",
"config:PutConfigRule",
"config:StartConfigRulesEvaluation",
"config:DeleteEvaluationResults"
],
"Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/fms.amazonaws.com/*"
},
{
"Sid": "ConfigUnscoped",
"Effect": "Allow",
"Action": [
"config:DescribeComplianceByConfigRule",
"config:DescribeConfigurationRecorders",
"config:DescribeConfigurationRecorderStatus",
"config:DescribeConfigRules",
"config:DescribeConfigRuleEvaluationStatus",
"config:PutConfigurationRecorder",
"config:StartConfigurationRecorder",
"config:PutDeliveryChannel",
"config:DescribeDeliveryChannels",
"config:DescribeDeliveryChannelStatus",
"config:GetComplianceSummaryByConfigRule",
"config:GetDiscoveredResourceCounts",
"config:PutEvaluations",
"config:SelectResourceConfig",
"config:BatchGetResourceConfig"
],
"Resource": "*"
},
{
"Sid": "SlrDeletion",
"Effect": "Allow",
"Action": [
"iam:DeleteServiceLinkedRole",
"iam:GetServiceLinkedRoleDeletionStatus"
],
"Resource": [
"arn:aws:iam::*:role/aws-service-role/fms.amazonaws.com/AWSServiceRoleForFMS"
]
},
{
"Sid": "OrganizationsGeneral",
"Effect": "Allow",
"Action": [
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"organizations:DescribeOrganizationalUnit",
"organizations:ListChildren",
"organizations:ListRoots",
"organizations:ListParents",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListAWSServiceAccessForOrganization"
],
"Resource": [
"*"
]
},
{
"Sid": "ShieldGeneral",
"Effect": "Allow",
"Action": [
"shield:CreateProtection",
"shield:DeleteProtection",
"shield:DescribeProtection",
"shield:ListProtections",
"shield:ListAttacks",
"shield:CreateSubscription",
"shield:DescribeSubscription",
"shield:GetSubscriptionState",
"shield:DescribeDRTAccess",
"shield:DescribeEmergencyContactSettings",
"shield:UpdateEmergencyContactSettings",
"elasticloadbalancing:DescribeLoadBalancers",
"ec2:DescribeAddresses",
"shield:EnableApplicationLayerAutomaticResponse",
"shield:DisableApplicationLayerAutomaticResponse",
"shield:UpdateApplicationLayerAutomaticResponse"
],
"Resource": "*"
},
{
"Sid": "EC2SecurityGroupScoped",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DeleteSecurityGroup",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid": "SecurityGroupTagCreation",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateSecurityGroup"
}
}
},
{
"Sid": "SecurityGroupTagManagement",
"Effect": "Allow",
"Action": [
"ec2:DeleteTags",
"ec2:CreateTags"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringLike": {
"aws:ResourceTag/FMManaged": "*"
}
}
},
{
"Sid": "Ec2Unscoped",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup",
"ec2:DescribeSecurityGroupReferences",
"ec2:DescribeSecurityGroups",
"ec2:DescribeStaleSecurityGroups",
"ec2:DescribeNetworkInterfaces",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:DescribeVpcs",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeInstances",
"ec2:AssociateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateRouteTable",
"ec2:DeleteSubnet",
"ec2:DisassociateRouteTable",
"ec2:ReplaceRouteTableAssociation"
],
"Resource": [
"*"
]
},
{
"Sid": "Wafv2General",
"Effect": "Allow",
"Action": [
"wafv2:TagResource",
"wafv2:ListResourcesForWebACL",
"wafv2:AssociateWebACL",
"wafv2:ListTagsForResource",
"wafv2:UntagResource",
"wafv2:GetWebACL",
"wafv2:DisassociateFirewallManager",
"wafv2:DeleteWebACL",
"wafv2:DisassociateWebACL"
],
"Resource": [
"arn:aws:wafv2:*:*:global/webacl/*",
"arn:aws:wafv2:*:*:regional/webacl/*"
]
},
{
"Sid": "Wafv2WebAclAndRuleGroupMutation",
"Effect": "Allow",
"Action": [
"wafv2:UpdateWebACL",
"wafv2:CreateWebACL",
"wafv2:DeleteFirewallManagerRuleGroups",
"wafv2:PutFirewallManagerRuleGroups"
],
"Resource": [
"arn:aws:wafv2:*:*:global/webacl/*",
"arn:aws:wafv2:*:*:regional/webacl/*",
"arn:aws:wafv2:*:*:global/rulegroup/*",
"arn:aws:wafv2:*:*:regional/rulegroup/*",
"arn:aws:wafv2:*:*:global/managedruleset/*",
"arn:aws:wafv2:*:*:regional/managedruleset/*",
"arn:aws:wafv2:*:*:global/ipset/*",
"arn:aws:wafv2:*:*:regional/ipset/*",
"arn:aws:wafv2:*:*:global/regexpatternset/*",
"arn:aws:wafv2:*:*:regional/regexpatternset/*"
]
},
{
"Sid": "Wafv2PermissionPolicy",
"Effect": "Allow",
"Action": [
"wafv2:PutPermissionPolicy",
"wafv2:GetPermissionPolicy",
"wafv2:DeletePermissionPolicy"
],
"Resource": [
"arn:aws:wafv2:*:*:global/rulegroup/*",
"arn:aws:wafv2:*:*:regional/rulegroup/*"
]
},
{
"Sid": "Wafv2WebaclDescribe",
"Effect": "Allow",
"Action": [
"wafv2:GetWebACLForResource"
],
"Resource": [
"arn:aws:wafv2:*:*:regional/webacl/*"
]
},
{
"Sid": "RouteTableTagManagement",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*:*:route-table/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateRouteTable"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
}
}
},
{
"Sid": "SubnetTagManagement",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
}
}
},
{
"Sid": "VPCEndpointTagManagement",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*"
],
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateVpcEndpoint"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
}
}
},
{
"Sid": "RouteTableCleanup",
"Effect": "Allow",
"Action": "ec2:DeleteRouteTable",
"Resource": "arn:aws:ec2:*:*:route-table/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "Ec2DescribeUnscoped",
"Effect": "Allow",
"Action": [
"ec2:DescribeInternetGateways",
"ec2:DescribeRouteTables",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeAvailabilityZones"
],
"Resource": "*"
},
{
"Sid": "CreateVpcEndpointScoped",
"Effect": "Allow",
"Action": "ec2:CreateVpcEndpoint",
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/FMManaged": [
"true"
]
}
}
},
{
"Sid": "CreateVpcEndpointUnscoped",
"Effect": "Allow",
"Action": "ec2:CreateVpcEndpoint",
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid": "VpcEndpointsDeletion",
"Effect": "Allow",
"Action": [
"ec2:DeleteVpcEndpoints"
],
"Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "RamTagManagement",
"Effect": "Allow",
"Action": [
"ram:TagResource"
],
"Resource": [
"arn:aws:ram:*:*:resource-share/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
}
}
},
{
"Sid": "RamMutation",
"Effect": "Allow",
"Action": [
"ram:AssociateResourceShare",
"ram:UpdateResourceShare",
"ram:DeleteResourceShare"
],
"Resource": "arn:aws:ram:*:*:resource-share/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "RamCreation",
"Effect": "Allow",
"Action": "ram:CreateResourceShare",
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
},
"StringEquals": {
"aws:RequestTag/FMManaged": [
"true"
]
}
}
},
{
"Sid": "RamDescribe",
"Effect": "Allow",
"Action": [
"ram:GetResourceShareAssociations",
"ram:GetResourceShares"
],
"Resource": "*"
},
{
"Sid": "SlrCreation",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "*",
"Condition": {
"StringEquals": {
"iam:AWSServiceName": [
"network-firewall.amazonaws.com",
"shield.amazonaws.com"
]
}
}
},
{
"Sid": "IamDescribe",
"Effect": "Allow",
"Action": "iam:GetRole",
"Resource": "*"
},
{
"Sid": "NetworkFirewallTagManagement",
"Effect": "Allow",
"Action": [
"network-firewall:TagResource"
],
"Resource": "*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged"
]
}
}
},
{
"Sid": "NetworkFirewallGeneral",
"Effect": "Allow",
"Action": [
"network-firewall:AssociateSubnets",
"network-firewall:CreateFirewall",
"network-firewall:CreateFirewallPolicy",
"network-firewall:DisassociateSubnets",
"network-firewall:UpdateFirewallDeleteProtection",
"network-firewall:UpdateFirewallPolicy",
"network-firewall:UpdateFirewallPolicyChangeProtection",
"network-firewall:UpdateSubnetChangeProtection",
"network-firewall:AssociateFirewallPolicy",
"network-firewall:DescribeFirewall",
"network-firewall:DescribeFirewallPolicy",
"network-firewall:DescribeRuleGroup",
"network-firewall:ListFirewallPolicies",
"network-firewall:ListFirewalls",
"network-firewall:ListRuleGroups",
"network-firewall:DescribeResourcePolicy",
"network-firewall:DeleteResourcePolicy",
"network-firewall:DescribeLoggingConfiguration",
"network-firewall:UpdateLoggingConfiguration",
"network-firewall:DescribeTLSInspectionConfiguration",
"network-firewall:ListTLSInspectionConfigurations"
],
"Resource": "*"
},
{
"Sid": "NetworkFirewallResourcePolicy",
"Effect": "Allow",
"Action": [
"network-firewall:PutResourcePolicy"
],
"Resource": [
"arn:aws:network-firewall:*:*:firewall-policy/*",
"arn:aws:network-firewall:*:*:stateful-rulegroup/*",
"arn:aws:network-firewall:*:*:stateless-rulegroup/*"
]
},
{
"Sid": "NetworkFirewallCleanup",
"Effect": "Allow",
"Action": [
"network-firewall:DeleteFirewallPolicy",
"network-firewall:DeleteFirewall"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "LogsGeneral",
"Effect": "Allow",
"Action": [
"logs:ListLogDeliveries",
"logs:CreateLogDelivery",
"logs:GetLogDelivery",
"logs:UpdateLogDelivery",
"logs:DeleteLogDelivery"
],
"Resource": "*"
},
{
"Sid": "Route53ResolverRuleGroupUnscoped",
"Effect": "Allow",
"Action": [
"route53resolver:ListFirewallRuleGroupAssociations",
"route53resolver:ListTagsForResource",
"route53resolver:ListFirewallRuleGroups",
"route53resolver:GetFirewallRuleGroupAssociation",
"route53resolver:GetFirewallRuleGroup",
"route53resolver:GetFirewallRuleGroupPolicy",
"route53resolver:PutFirewallRuleGroupPolicy"
],
"Resource": "*"
},
{
"Sid": "Route53ResolverRuleGroupCleanup",
"Effect": "Allow",
"Action": [
"route53resolver:UpdateFirewallRuleGroupAssociation",
"route53resolver:DisassociateFirewallRuleGroup"
],
"Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "Route53ResolverRuleGroupScoped",
"Effect": "Allow",
"Action": [
"route53resolver:AssociateFirewallRuleGroup",
"route53resolver:TagResource"
],
"Resource": "arn:aws:route53resolver:*:*:firewall-rule-group-association/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/FMManaged": "true"
}
}
},
{
"Sid": "NaclTagCreation",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:network-acl/*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged",
"FMPolicies"
]
},
"StringEquals": {
"ec2:CreateAction": "CreateNetworkAcl"
}
}
},
{
"Sid": "NaclTagManagement",
"Effect": "Allow",
"Action": [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource": "arn:aws:ec2:*:*:network-acl/*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"Name",
"FMManaged",
"FMPolicies"
]
},
"StringEquals": {
"aws:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "NaclScoped",
"Effect": "Allow",
"Action": [
"ec2:DeleteNetworkAclEntry",
"ec2:CreateNetworkAclEntry",
"ec2:ReplaceNetworkAclEntry",
"ec2:DeleteNetworkAcl"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/FMManaged": "true"
}
}
},
{
"Sid": "NaclUnscoped",
"Effect": "Allow",
"Action": [
"ec2:ReplaceNetworkAclAssociation",
"ec2:DescribeNetworkAcls",
"ec2:CreateNetworkAcl"
],
"Resource": "*"
}
]
},
"VersionId": "v37",
"IsDefaultVersion": true,
"CreateDate": "2026-04-06T21:57:08+00:00"
}
}Version History (39 recorded)
Raw historyv37updated
1 action added
v36updated
scope changed, no action added or removed
FMSServiceRolePolicy - Policy Version v36
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
e0a1605FMSServiceRolePolicy - Policy Version v34
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
9bb3cc5Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 21, 2025
b1204dbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 11, 2025
8101b1dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 22, 2024
0c1bc7aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 22, 2024
d01c3c8Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 21, 2023
5c5871cUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 4, 2023
938cab0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 15, 2022
d843777Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 24, 2022
d6719f9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 28, 2022
3c1542fUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Feb 16, 2022
cb7f843Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 6, 2022
8482d61Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 18, 2021
76f2bbdUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 30, 2021
22a2967Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 12, 2021
665b3e9