Deprecated
Removed from AWS on 2024-11-21 - Active for 4 years, 1 month
ServerMigration_ServiceRole
Last Modified
Sep 18, 2024
September 18, 2024 at 10:06 AM UTC
Version
v2
Total Versions
2
Created
Oct 15, 2020
Actions
55
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 2 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:PassedToService
- cloudformation:CreateStack: condition cloudformation:ResourceTypes, on arn:aws:cloudformation:*:*:stack/sms-app-*/*
- cloudformation:CreateChangeSet: condition cloudformation:ResourceTypes, on arn:aws:cloudformation:*:*:stack/sms-app-*/*
- cloudformation:ExecuteChangeSet: on arn:aws:cloudformation:*:*:stack/sms-app-*/*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can take over existing resources that run as another role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- ssm:SendCommand: on arn:aws:ssm:*::document/AWS-RunRemoteScript, arn:aws:s3:::sms-app-*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
Policy Document
View on GitHub{
"PolicyVersion": {
"CreateDate": "2020-10-15T17:26:32Z",
"VersionId": "v2",
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"cloudformation:CreateChangeSet",
"cloudformation:CreateStack"
],
"Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*",
"Effect": "Allow",
"Condition": {
"Null": {
"cloudformation:ResourceTypes": "false"
},
"ForAllValues:StringEquals": {
"cloudformation:ResourceTypes": [
"AWS::EC2::Instance",
"AWS::ApplicationInsights::Application",
"AWS::ResourceGroups::Group"
]
}
}
},
{
"Action": [
"cloudformation:DeleteStack",
"cloudformation:ExecuteChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResource",
"cloudformation:DescribeStackResources",
"cloudformation:GetTemplate"
],
"Resource": "arn:aws:cloudformation:*:*:stack/sms-app-*/*",
"Effect": "Allow"
},
{
"Action": [
"cloudformation:ValidateTemplate",
"s3:ListAllMyBuckets"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:DeleteObject",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:PutLifecycleConfiguration"
],
"Resource": "arn:aws:s3:::sms-app-*",
"Effect": "Allow"
},
{
"Action": [
"sms:CreateReplicationJob",
"sms:DeleteReplicationJob",
"sms:GetReplicationJobs",
"sms:GetReplicationRuns",
"sms:GetServers",
"sms:ImportServerCatalog",
"sms:StartOnDemandReplicationRun",
"sms:UpdateReplicationJob"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ssm:SendCommand",
"Resource": [
"arn:aws:ssm:*::document/AWS-RunRemoteScript",
"arn:aws:s3:::sms-app-*"
],
"Effect": "Allow"
},
{
"Action": "ssm:SendCommand",
"Resource": "arn:aws:ec2:*:*:instance/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ssm:resourceTag/UseForSMSApplicationValidation": [
"true"
]
}
}
},
{
"Action": [
"ssm:CancelCommand",
"ssm:GetCommandInvocation"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CopySnapshot"
}
}
},
{
"Action": "ec2:CopySnapshot",
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Effect": "Allow",
"Condition": {
"StringLike": {
"aws:RequestTag/SMSJobId": [
"sms-*"
]
}
}
},
{
"Action": [
"ec2:ModifySnapshotAttribute",
"ec2:DeleteSnapshot"
],
"Resource": "arn:aws:ec2:*:*:snapshot/*",
"Effect": "Allow",
"Condition": {
"StringLike": {
"ec2:ResourceTag/SMSJobId": [
"sms-*"
]
}
}
},
{
"Action": [
"ec2:CopyImage",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeSnapshotAttribute",
"ec2:DeregisterImage",
"ec2:ImportImage",
"ec2:DescribeImportImageTasks",
"ec2:GetEbsEncryptionByDefault"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"iam:GetRole",
"iam:GetInstanceProfile"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"ec2:DisassociateIamInstanceProfile",
"ec2:AssociateIamInstanceProfile",
"ec2:ReplaceIamInstanceProfileAssociation"
],
"Resource": "arn:aws:ec2:*:*:instance/*",
"Effect": "Allow",
"Condition": {
"StringLike": {
"ec2:ResourceTag/aws:cloudformation:stack-id": "arn:aws:cloudformation:*:*:stack/sms-app-*/*"
}
}
},
{
"Action": "iam:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"iam:PassedToService": "ec2.amazonaws.com"
}
}
},
{
"Action": "iam:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEqualsIfExists": {
"iam:PassedToService": "cloudformation.amazonaws.com"
},
"StringLike": {
"iam:AssociatedResourceArn": "arn:aws:cloudformation:*:*:stack/sms-app-*/*"
}
}
}
]
},
"IsDefaultVersion": true
}
}Version History (4 recorded)
Raw historyUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 15, 2020
aab43a3Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 12, 2020
aaae935