NetworkAdministrator
Last Modified
Jul 9, 2026
July 9, 2026 at 03:03 PM UTC
Version
v16
Total Versions
17
Created
Jul 9, 2026
Actions
242
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can switch off security monitoring
Can delete VPC flow logs, which is how an intruder hides.
ec2:DeleteFlowLogsUse with caution: Deny these actions with an SCP for everyone outside a break-glass role, so no single policy can blind you.
- Medium
Can rewrite resource policies and sharing
Grants 5 permissions management actions across 2 services (ec2, networkmanager) on any resource, enough to share resources outside the account.
ec2:createnetworkinterfacepermissionec2:deletenetworkinterfacepermissionec2:modifyvpcendpointservicepermissionsnetworkmanager:deleteresourcepolicynetworkmanager:putresourcepolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full access to 5 services on every resource
Uses directconnect:*, elasticloadbalancing:*, networkmanager:*, route53:*, route53domains:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
directconnect:*elasticloadbalancing:*networkmanager:*route53:*route53domains:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDefaultNetworkAdminActions",
"Effect": "Allow",
"Action": [
"autoscaling:Describe*",
"cloudfront:ListDistributions",
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms",
"cloudwatch:GetMetricStatistics",
"cloudwatch:PutMetricAlarm",
"directconnect:*",
"ec2:AcceptVpcEndpointConnections",
"ec2:AllocateAddress",
"ec2:AssignIpv6Addresses",
"ec2:AssignPrivateIpAddresses",
"ec2:AssociateAddress",
"ec2:AssociateDhcpOptions",
"ec2:AssociateRouteTable",
"ec2:AssociateSubnetCidrBlock",
"ec2:AssociateVpcCidrBlock",
"ec2:AttachInternetGateway",
"ec2:AttachNetworkInterface",
"ec2:AttachVpnGateway",
"ec2:CreateCarrierGateway",
"ec2:CreateCustomerGateway",
"ec2:CreateDefaultSubnet",
"ec2:CreateDefaultVpc",
"ec2:CreateDhcpOptions",
"ec2:CreateEgressOnlyInternetGateway",
"ec2:CreateFlowLogs",
"ec2:CreateInternetGateway",
"ec2:CreateNatGateway",
"ec2:CreateNetworkAcl",
"ec2:CreateNetworkAclEntry",
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:CreatePlacementGroup",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateTags",
"ec2:CreateVpc",
"ec2:CreateVpcEndpoint",
"ec2:CreateVpcEndpointConnectionNotification",
"ec2:CreateVpcEndpointServiceConfiguration",
"ec2:CreateVpnConnection",
"ec2:CreateVpnConnectionRoute",
"ec2:CreateVpnGateway",
"ec2:DeleteCarrierGateway",
"ec2:DeleteEgressOnlyInternetGateway",
"ec2:DeleteFlowLogs",
"ec2:DeleteNatGateway",
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission",
"ec2:DeletePlacementGroup",
"ec2:DeleteSubnet",
"ec2:DeleteTags",
"ec2:DeleteVpc",
"ec2:DeleteVpcEndpointConnectionNotifications",
"ec2:DeleteVpcEndpointServiceConfigurations",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteVpnConnection",
"ec2:DeleteVpnConnectionRoute",
"ec2:DeleteVpnGateway",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeCarrierGateways",
"ec2:DescribeClassicLinkInstances",
"ec2:DescribeCustomerGateways",
"ec2:DescribeDhcpOptions",
"ec2:DescribeEgressOnlyInternetGateways",
"ec2:DescribeFlowLogs",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeIpv6Pools",
"ec2:DescribeKeyPairs",
"ec2:DescribeMovingAddresses",
"ec2:DescribeNatGateways",
"ec2:DescribeNetworkAcls",
"ec2:DescribeNetworkInterfaceAttribute",
"ec2:DescribeNetworkInterfacePermissions",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribePlacementGroups",
"ec2:DescribePrefixLists",
"ec2:DescribePublicIpv4Pools",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroupReferences",
"ec2:DescribeSecurityGroupRules",
"ec2:DescribeSecurityGroups",
"ec2:DescribeStaleSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeTags",
"ec2:DescribeVpcAttribute",
"ec2:DescribeVpcClassicLink",
"ec2:DescribeVpcClassicLinkDnsSupport",
"ec2:DescribeVpcEndpointConnectionNotifications",
"ec2:DescribeVpcEndpointConnections",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcEndpointServicePermissions",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcPeeringConnections",
"ec2:DescribeVpcs",
"ec2:DescribeVpnConnections",
"ec2:DescribeVpnGateways",
"ec2:DetachInternetGateway",
"ec2:DetachNetworkInterface",
"ec2:DetachVpnGateway",
"ec2:DisableVgwRoutePropagation",
"ec2:DisableVpcClassicLinkDnsSupport",
"ec2:DisassociateAddress",
"ec2:DisassociateRouteTable",
"ec2:DisassociateSubnetCidrBlock",
"ec2:DisassociateVpcCidrBlock",
"ec2:EnableVgwRoutePropagation",
"ec2:EnableVpcClassicLinkDnsSupport",
"ec2:GetVpnConnectionDeviceSampleConfiguration",
"ec2:GetVpnConnectionDeviceTypes",
"ec2:GetVpnTunnelReplacementStatus",
"ec2:ModifyNetworkInterfaceAttribute",
"ec2:ModifySecurityGroupRules",
"ec2:ModifySubnetAttribute",
"ec2:ModifyVpcAttribute",
"ec2:ModifyVpcEndpoint",
"ec2:ModifyVpcEndpointConnectionNotification",
"ec2:ModifyVpcEndpointServiceConfiguration",
"ec2:ModifyVpcEndpointServicePermissions",
"ec2:ModifyVpcPeeringConnectionOptions",
"ec2:ModifyVpcTenancy",
"ec2:ModifyVpnConnection",
"ec2:ModifyVpnConnectionOptions",
"ec2:ModifyVpnTunnelCertificate",
"ec2:ModifyVpnTunnelOptions",
"ec2:MoveAddressToVpc",
"ec2:RejectVpcEndpointConnections",
"ec2:ReleaseAddress",
"ec2:ReplaceNetworkAclAssociation",
"ec2:ReplaceNetworkAclEntry",
"ec2:ReplaceRoute",
"ec2:ReplaceRouteTableAssociation",
"ec2:ReplaceVpnTunnel",
"ec2:ResetNetworkInterfaceAttribute",
"ec2:RestoreAddressToClassic",
"ec2:UnassignIpv6Addresses",
"ec2:UnassignPrivateIpAddresses",
"ec2:UpdateSecurityGroupRuleDescriptionsEgress",
"ec2:UpdateSecurityGroupRuleDescriptionsIngress",
"elasticbeanstalk:Describe*",
"elasticbeanstalk:List*",
"elasticbeanstalk:RequestEnvironmentInfo",
"elasticbeanstalk:RetrieveEnvironmentInfo",
"elasticloadbalancing:*",
"interconnect:AcceptConnectionProposal",
"interconnect:CreateConnection",
"interconnect:DeleteConnection",
"interconnect:DescribeConnectionProposal",
"interconnect:GetConnection",
"interconnect:GetEnvironment",
"interconnect:ListAttachPoints",
"interconnect:ListConnections",
"interconnect:ListEnvironments",
"interconnect:ListTagsForResource",
"interconnect:TagResource",
"interconnect:UntagResource",
"interconnect:UpdateConnection",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"logs:GetLogEvents",
"route53:*",
"route53domains:*",
"sns:CreateTopic",
"sns:ListSubscriptionsByTopic",
"sns:ListTopics"
],
"Resource": "*"
},
{
"Sid": "AllowVPCPermissions",
"Effect": "Allow",
"Action": [
"ec2:AcceptVpcPeeringConnection",
"ec2:AssociateSecurityGroupVpc",
"ec2:AttachClassicLinkVpc",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateVpcPeeringConnection",
"ec2:DeleteCustomerGateway",
"ec2:DeleteDhcpOptions",
"ec2:DeleteInternetGateway",
"ec2:DeleteNetworkAcl",
"ec2:DeleteNetworkAclEntry",
"ec2:DeleteRoute",
"ec2:DeleteRouteTable",
"ec2:DeleteSecurityGroup",
"ec2:DeleteVolume",
"ec2:DeleteVpcPeeringConnection",
"ec2:DescribeSecurityGroupVpcAssociations",
"ec2:DetachClassicLinkVpc",
"ec2:DisableVpcClassicLink",
"ec2:DisassociateSecurityGroupVpc",
"ec2:EnableVpcClassicLink",
"ec2:GetConsoleScreenshot",
"ec2:GetSecurityGroupsForVpc",
"ec2:RejectVpcPeeringConnection",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": [
"*"
]
},
{
"Sid": "AllowLocalGatewayPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateLocalGatewayRoute",
"ec2:CreateLocalGatewayRouteTableVpcAssociation",
"ec2:DeleteLocalGatewayRoute",
"ec2:DeleteLocalGatewayRouteTableVpcAssociation",
"ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
"ec2:DescribeLocalGatewayRouteTableVpcAssociations",
"ec2:DescribeLocalGatewayRouteTables",
"ec2:DescribeLocalGatewayVirtualInterfaceGroups",
"ec2:DescribeLocalGatewayVirtualInterfaces",
"ec2:DescribeLocalGateways",
"ec2:SearchLocalGatewayRoutes"
],
"Resource": "*"
},
{
"Sid": "DiscoverBuckets",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketWebsite",
"s3:ListBucket"
],
"Resource": [
"*"
]
},
{
"Sid": "DiscoverFlowLogRoles",
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListRoles",
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/flow-logs-*"
},
{
"Sid": "NetworkmanagerPermissions",
"Effect": "Allow",
"Action": [
"networkmanager:*"
],
"Resource": "*"
},
{
"Sid": "TransitGatewayPermissions",
"Effect": "Allow",
"Action": [
"ec2:AcceptTransitGatewayVpcAttachment",
"ec2:AssociateTransitGatewayRouteTable",
"ec2:CreateTransitGateway",
"ec2:CreateTransitGatewayRoute",
"ec2:CreateTransitGatewayRouteTable",
"ec2:CreateTransitGatewayVpcAttachment",
"ec2:DeleteTransitGateway",
"ec2:DeleteTransitGatewayRoute",
"ec2:DeleteTransitGatewayRouteTable",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:DescribeTransitGatewayAttachments",
"ec2:DescribeTransitGatewayRouteTables",
"ec2:DescribeTransitGateways",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DisableTransitGatewayRouteTablePropagation",
"ec2:DisassociateTransitGatewayRouteTable",
"ec2:EnableTransitGatewayRouteTablePropagation",
"ec2:ExportTransitGatewayRoutes",
"ec2:GetTransitGatewayAttachmentPropagations",
"ec2:GetTransitGatewayRouteTableAssociations",
"ec2:GetTransitGatewayRouteTablePropagations",
"ec2:ModifyTransitGateway",
"ec2:ModifyTransitGatewayVpcAttachment",
"ec2:RejectTransitGatewayVpcAttachment",
"ec2:ReplaceTransitGatewayRoute",
"ec2:SearchTransitGatewayRoutes"
],
"Resource": "*"
},
{
"Sid": "AllowTransitGatewaySLRCreation",
"Effect": "Allow",
"Action": [
"iam:CreateServiceLinkedRole"
],
"Resource": "*",
"Condition": {
"StringLike": {
"iam:AWSServiceName": [
"transitgateway.amazonaws.com"
]
}
}
}
]
},
"VersionId": "v16",
"IsDefaultVersion": true,
"CreateDate": "2026-07-09T14:42:15+00:00"
}
}Version History (22 recorded)
Raw history13 actions added
scope changed, no action added or removed
NetworkAdministrator - Policy Version v15
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
8a245e7NetworkAdministrator - Policy Version v14
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
229e304Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Dec 19, 2024
404bdf3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 26, 2024
513f44aUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2021
00aabf6Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 3, 2021
a3cf083Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 20, 2021
f2f03dcUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 25, 2020
65d32a5Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 8, 2020
66c333cUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 31, 2020
348c676Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 16, 2020
86cf197Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
49aa1d0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
71619cfUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 16, 2019
8279033`2019-08-29`
No recorded action delta - this version predates the change index. View the raw diff.
Aug 29, 2019
5016d52I updated my CLI and it looks like it reordered everything and changed the white-space, so everything looks changed, but is not
No recorded action delta - this version predates the change index. View the raw diff.
Jul 12, 2019
9d2dff1