AWSMarketplaceImageBuildFullAccess

Summary

Provides full access to the AWS Marketplace Private Image Build feature, plus permissions to add tags to images and to launch and terminate EC2 instances. The AWS Marketplace Buyer Guide lists the policy as deprecated.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccessCopy ARN

Default version

v3

Created

2018-07-31

Last edited

2022-03-04

Services

aws-marketplace, ec2, iam, s3, sns, ssm

Control-plane actions (23)

By access level: 6 List, 7 Read, 1 Tagging, 9 Write.

Data-plane actions (3)

By access level: 1 List, 1 Read, 1 Write.

Excluded and conditional actions

• ec2:CreateTags (deny-conditional, statement 9): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 11 write, tagging or permissions-management actions, short of full control of any service.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Related policies

Same service

• AccessAnalyzerServiceRolePolicy
• AccountManagementFromVercel
• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AIOpsOperatorAccess
• AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy

Same domain

• AmazonBraketJobsExecutionPolicy
• AmazonDMSVPCManagementRole
• AmazonDRSVPCManagement
• AmazonEBSCSIDriverEKSClusterScopedPolicy
• AmazonEBSCSIDriverPolicy
• AmazonEBSCSIDriverPolicyV2
• AmazonEC2ContainerServiceRole
• AmazonEC2FullAccess

Frequently asked questions

When should I attach AWSMarketplaceImageBuildFullAccess?

The reference page says you can attach AWSMarketplaceImageBuildFullAccess to your users, groups and roles. However, the AWS Marketplace Buyer Guide lists it as deprecated and says AWS Marketplace discontinued the Private Image Build delivery method, so check whether you still need it before attaching it.

What does AWSMarketplaceImageBuildFullAccess grant?

It allows aws-marketplace build actions, EC2 actions such as ec2:RunInstances, ec2:CreateImage and ec2:TerminateInstances, SSM automation, s3:GetObject and s3:ListBucket on ARNs matching arn:aws:s3:::*image-build*, sns:Publish on ARNs matching arn:aws:sns:*:*:*image-build*, and iam:PassRole in two statements. 10 statements in total.

What are the security risks of AWSMarketplaceImageBuildFullAccess?

It can launch and terminate instances, delete images and snapshots, and pass roles to EC2 and SSM. The Buyer Guide lists it as deprecated. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:ListBuilds",
        "aws-marketplace:StartBuild",
        "aws-marketplace:DescribeBuilds"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ec2:TerminateInstances",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ec2:ResourceTag/marketplace-image-build:build-id": "*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/*Automation*",
        "arn:aws:iam::*:role/*Instance*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "ec2.amazonaws.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetAutomationExecution",
        "ssm:ListDocuments",
        "ssm:DescribeDocument",
        "ec2:DeregisterImage",
        "ec2:CopyImage",
        "ec2:DescribeSnapshots",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeImages",
        "ec2:DescribeSubnets",
        "ec2:DeleteSnapshot",
        "ec2:CreateImage",
        "ec2:RunInstances",
        "ec2:DescribeInstanceStatus",
        "sns:GetTopicAttributes",
        "iam:GetRole",
        "iam:GetInstanceProfile"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::*image-build*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*::image/*",
        "arn:aws:ec2:*:*:instance/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "sns:Publish"
      ],
      "Resource": [
        "arn:aws:sns:*:*:*image-build*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:StartAutomationExecution"
      ],
      "Resource": [
        "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*",
        "arn:aws:ssm:us-east-1:058657716661:automation-definition/*",
        "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*",
        "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*",
        "arn:aws:ssm:us-west-2:243045473901:automation-definition/*",
        "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*",
        "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*",
        "arn:aws:ssm:us-east-2:134937423163:automation-definition/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "iam:PassedToService": [
            "ssm.amazonaws.com"
          ],
          "iam:AssociatedResourceARN": [
            "arn:aws:ssm:eu-central-1:906690553262:automation-definition/*",
            "arn:aws:ssm:us-east-1:058657716661:automation-definition/*",
            "arn:aws:ssm:ap-northeast-1:340648487307:automation-definition/*",
            "arn:aws:ssm:eu-west-1:564714592864:automation-definition/*",
            "arn:aws:ssm:us-west-2:243045473901:automation-definition/*",
            "arn:aws:ssm:ap-southeast-2:362149219987:automation-definition/*",
            "arn:aws:ssm:eu-west-2:587945719687:automation-definition/*",
            "arn:aws:ssm:us-east-2:134937423163:automation-definition/*"
          ]
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*"
      ],
      "Condition": {
        "StringLike": {
          "aws:RequestTag/marketplace-image-build:build-id": "*"
        },
        "StringNotEquals": {
          "ec2:CreateAction": "RunInstances"
        }
      }
    }
  ]
}

Version history

Current version v3, edited by AWS on 2022-03-04. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess

resource "aws_iam_role_policy_attachment" "awsmarketplaceimagebuildfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSMarketplaceImageBuildFullAccess"),
);

Sources

• AWSMarketplaceImageBuildFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for AWS Marketplace buyers (AWS Marketplace Buyer Guide) (retrieved 2026-11-13; supports summary, useCases, securityConsiderations, assignmentGuidance, faqs)
• Grant a user permissions to pass a role to an AWS service (IAM User Guide) (retrieved 2026-11-13; supports securityConsiderations)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for AWSMarketplaceImageBuildFullAccess
• AWS service guide
• Report a data issue