Recommended Free Tools
A deny list that blocks six familiar AWS compute actions can still miss other ways to pass a role to a workload. In Bala Paranj’s example, the author’s registry contains nine compute-launch vectors and five are absent from the deny list—but only the Auto Scaling route is reported reachable under the example’s modeled policy conditions. That is a coverage finding, not proof that every listed route is exploitable in every AWS account.
What the nine-vector count means
Paranj compares a sample deny policy with a registry of nine ways to launch or configure compute using a role. The count describes the article’s registry, not a complete inventory of all AWS services or every API variant that can involve a role. The article reports that five registry entries are missing from its deny list.
As an Amazon Associate I earn from qualifying purchases.
| Registry vector | Listed in the sample deny? | What the article reports |
|---|---|---|
EC2 RunInstances |
Yes | One of the six covered action patterns. |
Lambda CreateFunction and UpdateFunctionConfiguration |
Yes | Covered by the sample’s Lambda action pattern. |
CloudFormation CreateStack |
Yes | Covered by the sample’s CloudFormation action pattern. The deny also includes cloudformation:UpdateStack, which the article does not count as a launch vector. |
Auto Scaling CreateLaunchConfiguration plus CreateAutoScalingGroup |
No | The uncovered route reported reachable in the modeled policy combination. |
ECS RunTask |
No | Uncovered by the action list, but blocked by the example’s current iam:PassedToService condition. |
CodeBuild CreateProject plus StartBuild |
No | Uncovered by the action list, but blocked by the example’s current iam:PassedToService condition. |
Glue CreateJob |
No | Uncovered by the action list, but blocked by the example’s current iam:PassedToService condition. |
SageMaker CreateNotebookInstance |
No | Uncovered by the action list, but blocked by the example’s current iam:PassedToService condition. |
| Ninth registry entry | — | The source enumerates nine vectors but the reviewed listing identifies eight distinct service/vector groupings above; do not infer a missing entry from this summary. |
The article also notes that lambda:InvokeFunction appears in the deny policy despite not being a launch vector. Read its comparison as a check of the author’s stated action list against the author’s stated registry, rather than as a general verdict on AWS policy completeness. Bala Paranj’s article gives the example and reported solver results.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why a missing deny is not the same as an exploitable path
An action absent from an explicit deny is not automatically permitted, and a permitted API call is not automatically a privilege escalation. Whether a route works depends on the effective permissions available to the principal, the role the service can receive, and that role’s trust relationship. AWS explains that iam:PassRole authorizes passing a role through a service API that uses it; the target role’s trust policy must also allow the service to assume it. The role’s attached permissions determine what its workload can do.
In the example, the Auto Scaling route matches the modeled EC2 service condition and is reported reachable. ECS, CodeBuild, Glue, and SageMaker are missing from the deny list, but the example’s iam:PassedToService condition does not match those destinations. That distinction is why reviewing action names alone can give an incomplete picture of the policy combination. The nine-vector registry is not evidence that every AWS account has nine exploitable paths, or that every future AWS service automatically creates a bypass.
Why scope iam:PassRole instead of relying only on a deny list
A deny list constrains named actions. A tightly scoped iam:PassRole permission constrains which role ARNs the principal can pass in the first place; adding iam:PassedToService can also limit the destination service. AWS recommends using the policy Resource element to restrict PassRole to approved roles. These controls address different parts of the risk and work best alongside a narrowly permissioned target role and an appropriate trust policy. See AWS guidance on granting a user permission to pass a role.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
- Role scope: list approved role ARNs in the PassRole statement’s
Resource, rather than using*when the principal does not need to pass every role. - Destination scope: use the
iam:PassedToServicecondition when the role should be passed only to particular service principals. - Role power: give the workload role only the permissions the workload needs; PassRole scope does not make an overpowered role safe.
- Trust: verify that the role’s trust policy names only the services and principals intended to assume it.
- Action coverage: review relevant service APIs and effective permissions as the account’s AWS usage changes; an action deny can be a useful additional guardrail, but its list requires maintenance.
EC2: avoid wildcard PassRole grants
For EC2, AWS documents PassRole alongside relevant instance-profile permissions and warns that setting the PassRole resource to * can authorize passing any IAM role in the account to an instance. Prefer the specific role ARN or ARNs required by the workflow. The EC2 console workflow may also require iam:ListInstanceProfiles; that is a workflow permission to account for, not a reason to broaden PassRole. Details are in AWS’s EC2 instructions for attaching an IAM role to an instance.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check managed-policy guidance for the service and version
Do not generalize the sample policy in Paranj’s article into a claim about current AWS-managed defaults. AWS’s current Amazon EMR managed-policy guidance distinguishes v1 and v2 policies: the full-permissions defaults described there scope PassRole to specific default EMR roles and specified service principals, and AWS recommends using v2 managed policies for new clusters. Review the applicable version and its exact permissions in the Amazon EMR managed policies guide.
Quick Recap
Rank #4
A practical policy-review sequence
- Identify the principal and workload. Determine which user, role, or automation identity can configure the service and which runtime role the workload is meant to receive.
- Enumerate the in-scope APIs and destinations. Include the exact create, update, launch, and start actions relevant to your services; do not assume the sample’s nine-entry registry is exhaustive.
- Evaluate the full effective policy combination. Check identity policies, explicit denies, conditions such as
iam:PassedToService, and any other applicable controls rather than treating the deny list as the whole decision. - Inspect both sides of role use. Confirm the principal can pass only approved role ARNs, then verify the target role’s trust policy and attached permissions.
- Revisit the inventory when usage changes. A newly adopted service or changed role-passing workflow can change which APIs and service principals need review.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
