Skip to main content
IAM Policy Map

AmazonSecurityLakePermissionsBoundary

High privilegeOperatorAWS managedActiveReviewedShow on mapCompare

Summary

A permissions boundary policy. Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from it, and uses this policy when creating those roles to define the boundary of their permissions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary
Default version
v2
Created
Last edited
Services
kms, s3, sqs

Control-plane actions (10)

By access level: 5 Read, 5 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
KMS2 of 582 Write; 0 restricted, 0 conditionalkms:Decrypt, kms:GenerateDataKey
S31 of 1551 Read; 0 restricted, 0 conditionals3:GetBucketLocation
SQS7 of 204 Read, 3 Write; 0 restricted, 0 conditionalsqs:ChangeMessageVisibility, sqs:DeleteMessage, sqs:GetQueueAttributes, sqs:GetQueueUrl, sqs:ListQueues, sqs:ReceiveMessage, sqs:SendMessage
KMS: 2 actions
  • kms:Decrypt (Write)
  • kms:GenerateDataKey (Write)
S3: 1 actions
  • s3:GetBucketLocation (Read)
SQS: 7 actions
  • sqs:ChangeMessageVisibility (Write)
  • sqs:DeleteMessage (Write)
  • sqs:GetQueueAttributes (Read)
  • sqs:GetQueueUrl (Read)
  • sqs:ListQueues (Read)
  • sqs:ReceiveMessage (Read)
  • sqs:SendMessage (Write)

Data-plane actions (5)

By access level: 2 List, 2 Read, 1 Write.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
S35 of 252 List, 2 Read, 1 Write; 0 restricted, 0 conditionals3:GetObject, s3:GetObjectVersion, s3:ListBucket, s3:ListBucketVersions, s3:PutObject
S3: 5 actions
  • s3:GetObject (Read)
  • s3:GetObjectVersion (Read)
  • s3:ListBucket (List)
  • s3:ListBucketVersions (List)
  • s3:PutObject (Write)

Excluded and conditional actions

  • kms:Decrypt (deny-not-action, statement 1): 1 matching actions
  • kms:GenerateDataKey (deny-not-action, statement 1): 1 matching actions
  • s3:GetBucketLocation (deny-not-action, statement 1): 1 matching actions
  • s3:GetObject (deny-not-action, statement 1): 1 matching actions
  • s3:GetObjectVersion (deny-not-action, statement 1): 1 matching actions
  • s3:ListBucket (deny-not-action, statement 1): 1 matching actions
  • s3:ListBucketVersions (deny-not-action, statement 1): 1 matching actions
  • s3:PutObject (deny-not-action, statement 1): 1 matching actions
  • sqs:ChangeMessageVisibility (deny-not-action, statement 1): 1 matching actions
  • sqs:DeleteMessage (deny-not-action, statement 1): 1 matching actions
  • sqs:GetQueueAttributes (deny-not-action, statement 1): 1 matching actions
  • sqs:GetQueueUrl (deny-not-action, statement 1): 1 matching actions
  • sqs:ListQueues (deny-not-action, statement 1): 1 matching actions
  • sqs:ReceiveMessage (deny-not-action, statement 1): 1 matching actions
  • sqs:SendMessage (deny-not-action, statement 1): 1 matching actions
  • s3:GetBucketLocation (deny-conditional, statement 2): 1 matching actions
  • s3:GetObject (deny-conditional, statement 2): 1 matching actions
  • s3:GetObjectVersion (deny-conditional, statement 2): 1 matching actions
  • s3:ListBucket (deny-conditional, statement 2): 1 matching actions
  • s3:ListBucketVersions (deny-conditional, statement 2): 1 matching actions
  • s3:PutObject (deny-conditional, statement 2): 1 matching actions
  • sqs:ChangeMessageVisibility (deny-conditional, statement 3): 1 matching actions
  • sqs:DeleteMessage (deny-conditional, statement 3): 1 matching actions
  • sqs:GetQueueAttributes (deny-conditional, statement 3): 1 matching actions
  • sqs:GetQueueUrl (deny-conditional, statement 3): 1 matching actions
  • sqs:ListQueues (deny-conditional, statement 3): 1 matching actions
  • sqs:ReceiveMessage (deny-conditional, statement 3): 1 matching actions
  • sqs:SendMessage (deny-conditional, statement 3): 1 matching actions
  • kms:Decrypt (deny-conditional, statement 4): 1 matching actions
  • kms:GenerateDataKey (deny-conditional, statement 4): 1 matching actions
  • kms:Decrypt (deny-conditional, statement 5): 1 matching actions
  • kms:GenerateDataKey (deny-conditional, statement 5): 1 matching actions
  • kms:Decrypt (deny-conditional, statement 6): 1 matching actions
  • kms:GenerateDataKey (deny-conditional, statement 6): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants 6 write, tagging or permissions-management actions, short of full control of any service.
  • Grants data-plane write actions on a data store on all resources without conditions.
  • Can read secret values or decrypt data. Reads are not a High privilege rule.

Guidance

Practical scope

Seven statements: one Allow of 15 S3, KMS and SQS actions on Resource "*", and six Deny statements (one with NotAction, two with NotResource and three on KMS actions with conditions). The Allow lists s3:GetObject, s3:GetObjectVersion, s3:ListBucket, s3:ListBucketVersions, s3:PutObject, s3:GetBucketLocation, kms:Decrypt, kms:GenerateDataKey and seven sqs actions (ReceiveMessage, ChangeMessageVisibility, DeleteMessage, GetQueueUrl, SendMessage, GetQueueAttributes, ListQueues).

Use cases

  • Set the maximum permissions for the IAM roles that Amazon Security Lake creates for third-party custom sources and subscribers. The Security Lake guide says you don't need to take action to use it.

Best practices

  • AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions.

Security considerations

  • A permissions boundary sets the maximum permissions an identity-based policy can grant: an entity can perform only the actions allowed by both its identity-based policies and its boundary. The IAM User Guide says a permissions boundary limits the maximum permissions but does not grant access on its own.
  • DenyActionsForSecurityLake is a Deny with NotAction on Resource "*", listing the same 15 actions as the Allow. NotAction matches every action except those listed, so it denies everything outside the 15.
  • DenyActionsNotOnSecurityLakeBucket denies six S3 actions (GetObject, GetObjectVersion, ListBucket, ListBucketVersions, PutObject, GetBucketLocation) with NotResource arn:aws:s3:::aws-security-data-lake*, so they are denied on ARNs that do not match that pattern. DenyActionsNotOnSecurityLakeSQS does the same for seven sqs actions with NotResource arn:aws:sqs:*:*:AmazonSecurityLake*.
  • Three more Deny statements cover kms:Decrypt and kms:GenerateDataKey on "*": one with StringNotLike on kms:ViaService (s3.*.amazonaws.com, sqs.*.amazonaws.com), and two with Null "false" plus StringNotLikeIfExists on the kms:EncryptionContext:aws:s3:arn key (arn:aws:s3:::aws-security-data-lake*) and the kms:EncryptionContext:aws:sqs:arn key (arn:aws:sqs:*:*:AmazonSecurityLake*).
  • The Security Lake guide adds that if the data lake is encrypted with a customer managed AWS KMS key, kms:Decrypt and kms:GenerateDataKey permissions are added.
  • You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

The reference page says you can attach it to your users, groups and roles, and IAM can use an AWS managed policy as the permissions boundary for a user or role. In practice the Security Lake User Guide says Security Lake uses it when it creates roles for third-party custom sources and subscribers, and that you don't need to take action to use it. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AmazonSecurityLakePermissionsBoundary?
The Security Lake User Guide says Security Lake uses this policy when it creates roles for third-party custom sources and subscribers, and that you don't need to take action to use it. The reference page says you can attach it to users, groups and roles. The IAM User Guide says a permissions boundary limits the maximum permissions but does not grant access on its own.
What does AmazonSecurityLakePermissionsBoundary grant?
It is a permissions boundary: one Allow of 15 S3, KMS and SQS actions on all resources, plus six Deny statements that deny any other action and restrict the S3, SQS and KMS actions by resource ARN pattern (aws-security-data-lake* and AmazonSecurityLake*) and by kms:ViaService and encryption context conditions.
What are the security risks of AmazonSecurityLakePermissionsBoundary?
A boundary limits permissions rather than adding them, but the Allow includes s3:GetObject, s3:PutObject, kms:Decrypt and sqs:SendMessage on "*", and the Deny statements are what narrow them. Check the NotAction and NotResource patterns match what you intend. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowActionsForSecurityLake",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:PutObject",
        "s3:GetBucketLocation",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "sqs:ReceiveMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:GetQueueUrl",
        "sqs:SendMessage",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyActionsForSecurityLake",
      "Effect": "Deny",
      "NotAction": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:PutObject",
        "s3:GetBucketLocation",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "sqs:ReceiveMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:GetQueueUrl",
        "sqs:SendMessage",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyActionsNotOnSecurityLakeBucket",
      "Effect": "Deny",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:PutObject",
        "s3:GetBucketLocation"
      ],
      "NotResource": [
        "arn:aws:s3:::aws-security-data-lake*"
      ]
    },
    {
      "Sid": "DenyActionsNotOnSecurityLakeSQS",
      "Effect": "Deny",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:GetQueueUrl",
        "sqs:SendMessage",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues"
      ],
      "NotResource": "arn:aws:sqs:*:*:AmazonSecurityLake*"
    },
    {
      "Sid": "DenyActionsNotOnSecurityLakeKMSS3SQS",
      "Effect": "Deny",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "kms:ViaService": [
            "s3.*.amazonaws.com",
            "sqs.*.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "DenyActionsNotOnSecurityLakeKMSForS3",
      "Effect": "Deny",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:s3:arn": "false"
        },
        "StringNotLikeIfExists": {
          "kms:EncryptionContext:aws:s3:arn": [
            "arn:aws:s3:::aws-security-data-lake*"
          ]
        }
      }
    },
    {
      "Sid": "DenyActionsNotOnSecurityLakeKMSForS3SQS",
      "Effect": "Deny",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:sqs:arn": "false"
        },
        "StringNotLikeIfExists": {
          "kms:EncryptionContext:aws:sqs:arn": [
            "arn:aws:sqs:*:*:AmazonSecurityLake*"
          ]
        }
      }
    }
  ]
}

Version history

Current version v2, edited by AWS on 2024-05-14. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary

Terraform

resource "aws_iam_role_policy_attachment" "amazonsecuritylakepermissionsboundary" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSecurityLakePermissionsBoundary"),
);

Sources