What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An explicit deny list can block familiar AWS compute actions and still miss other ways to pass a role to a service. In Bala Paranj’s example, the deny statement names six action patterns, while the author’s registry contains nine compute-launch vectors. Five are absent from that list; under the example’s modeled policy combination, Auto Scaling is the uncovered route reported as reachable. These are counts from one policy audit—not a claim that AWS has exactly nine such routes. Read the original analysis.
What the nine-vector count does—and does not—mean
The nine vectors in Paranj’s registry are API patterns that can launch or configure compute using a role:
- EC2:
RunInstances. - Lambda:
CreateFunctionandUpdateFunctionConfiguration. - CloudFormation:
CreateStack. - Auto Scaling:
CreateLaunchConfigurationfollowed byCreateAutoScalingGroup. - ECS:
RunTask. - CodeBuild:
CreateProjectfollowed byStartBuild. - Glue:
CreateJob. - SageMaker:
CreateNotebookInstance.
The source counts these as nine vectors, even though some involve more than one API call. It identifies five—Auto Scaling, ECS, CodeBuild, Glue, and SageMaker—as missing from its sample deny list. The list also denies cloudformation:UpdateStack and lambda:InvokeFunction, which the article notes are not launch vectors in this registry. Treat this as a coverage audit of the author’s chosen examples, not a complete inventory of every AWS API that can use a role.
Which gaps were reachable in the example?
An action missing from a deny statement is not, by itself, proof that a privilege-escalation path works. The request must also be allowed by the principal’s effective permissions, the relevant service API must accept a role, the principal must be allowed to pass that role, and the role’s trust relationship must permit the service to assume it. The role’s own permissions determine what the workload can do after assumption. AWS describes PassRole as permission used when calling a service API that receives a role, and documents the importance of both permission policies and role trust.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →In the article’s modeled policy combination, Auto Scaling is the uncovered vector reported as reachable because it matches the modeled EC2 service condition. ECS, CodeBuild, Glue, and SageMaker are also missing from the deny list, but do not match that example’s current iam:PassedToService condition. That distinction is why “not explicitly denied” and “exploitable under the complete configuration” are not interchangeable. The reported result belongs to the author’s example and solver analysis; it is not an independently reproduced test.
Why an action deny list is not the only control
A deny list constrains selected API actions. PassRole scope instead controls which IAM roles a principal may give to services. AWS recommends limiting PassRole to approved role ARNs in the policy’s Resource element. Its IAM guidance also documents the iam:PassedToService condition key to restrict the destination service when that restriction is appropriate. AWS: Grant a user permissions to pass a role to an AWS service.
Rank #2
- Matt-laminated and greaseproof pages ensure glare-free reading and long life
- The outside covers are made from a new rubberized material for better Handling and Grip
- All the Tool Holder Identification Sections now include a full INCH section along with a METRIC section
- Updated and Improved Index Searching
| Control or review area | What it constrains | What to check |
|---|---|---|
| Deny-list action coverage | Named API actions | Whether the specific role-using APIs relevant to your services are covered; revisit the inventory as your AWS use changes. |
iam:PassRole resource |
The roles a principal may pass | Use approved role ARNs rather than a wildcard resource when broad role passing is not intended. |
iam:PassedToService |
The service receiving the role | Apply an appropriate destination-service condition alongside role scope; it is not a substitute for checking permissions and trust. |
| Target role permissions and trust | The workload’s authority and which principals/services may assume the role | Give the role only intended permissions and ensure its trust policy names the intended service principals. |
A new AWS service does not automatically create a bypass. A future route matters only if there is an applicable role-passing or compute path, the caller has the necessary action permissions, and the PassRole grant and trust relationship allow it. The source raises coverage maintenance as an operational concern, but does not establish a rate at which AWS adds relevant services or APIs.
Review PassRole and instance-profile permissions for EC2
For EC2, AWS documents PassRole alongside the relevant instance-profile permissions. Its guidance warns that setting the PassRole resource to * grants access to pass any IAM role in the account to an instance, and recommends specifying role ARNs. The EC2 console workflow may also require iam:ListInstanceProfiles. AWS: Grant permissions to attach an IAM role to an instance.
This matters because applications on an EC2 instance can obtain temporary credentials through instance-profile metadata. The role’s attached permissions then define what those applications can do. A review should therefore inspect both the ability to attach/pass a role and the permissions of the role itself—not just the actions denied to the human or workload principal.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep service-specific guidance current: the EMR example
Do not generalize an older broad example policy into a claim about current EMR managed-policy defaults. AWS’s current EMR guidance distinguishes v1 and v2 managed policies; its full-permissions default policies scope PassRole to specific default EMR roles and specified service principals, and AWS recommends using v2 managed policies for new clusters. Check the current policy guidance that applies to your cluster and configuration: Amazon EMR managed policies.
Quick Recap
Rank #4
A practical policy-review sequence
- List the workload paths in scope. Identify the services and exact role-using APIs your principals can call; do not assume the nine-vector example is exhaustive.
- Evaluate the full effective policy combination. Check identity permissions and applicable explicit denies together, then determine whether the required API calls are actually allowed.
- Inspect each PassRole grant. Confirm its
Resourcenames only the role ARNs the principal should pass, and useiam:PassedToServicewhen a destination-service restriction is useful. - Inspect the target role. Verify its trust policy permits only intended services and its attached permissions are limited to what the workload needs.
- Review service-specific requirements. For EC2, account for instance-profile actions and console needs; for EMR, use current version-specific managed-policy guidance.
- Repeat when scope changes. Reassess the API and service inventory as the account’s AWS workloads and permissions change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
