AWSTransformInfrastructureExecutorAccessEC2

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, reading logs, and managing transformation schedules.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2
Default version: v4
Created: 2026-07-20
Last edited: 2026-10-22
Services: cloudformation, ec2, iam, kms, logs, s3, scheduler, secretsmanager, sqs, ssm, tag

Control-plane actions (49)

By access level: 19 List, 14 Read, 16 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudFormation	6 of 104	2 List, 4 Read; 5 restricted, 1 conditional	cloudformation:DescribeStackDriftDetectionStatus, cloudformation:DescribeStackEvents, cloudformation:DescribeStackResources, cloudformation:DescribeStacks, cloudformation:ListStacks, cloudformation:ValidateTemplate
EC2	11 of 834	9 List, 2 Write; 11 restricted, 11 conditional	ec2:DescribeImages, ec2:DescribeInstances, ec2:DescribeInternetGateways, ec2:DescribeKeyPairs, ec2:DescribeNatGateways, ec2:DescribeRouteTables, ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs, ec2:StartInstances, ec2:StopInstances
IAM	6 of 190	2 List, 3 Read, 1 Write; 6 restricted, 6 conditional	iam:GetInstanceProfile, iam:GetRole, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:ListRolePolicies, iam:PassRole
KMS	3 of 58	3 Write; 3 restricted, 3 conditional	kms:Decrypt, kms:Encrypt, kms:GenerateDataKey
CloudWatch Logs	4 of 133	4 Write; 4 restricted, 4 conditional	logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents, logs:PutRetentionPolicy
EventBridge Scheduler	7 of 13	2 List, 2 Read, 3 Write; 7 restricted, 7 conditional	scheduler:CreateSchedule, scheduler:DeleteSchedule, scheduler:GetSchedule, scheduler:GetScheduleGroup, scheduler:ListScheduleGroups, scheduler:ListSchedules, scheduler:UpdateSchedule
Secrets Manager	3 of 27	1 List, 2 Read; 3 restricted, 3 conditional	secretsmanager:DescribeSecret, secretsmanager:GetSecretValue, secretsmanager:ListSecrets
SQS	1 of 20	1 Write; 1 restricted, 1 conditional	sqs:SendMessage
Systems Manager	7 of 164	3 List, 2 Read, 2 Write; 7 restricted, 6 conditional	ssm:DescribeInstanceInformation, ssm:DescribeSessions, ssm:GetCommandInvocation, ssm:ListCommandInvocations, ssm:ListCommands, ssm:SendCommand, ssm:StartSession
Resource Group Tagging	1 of 9	1 Read; 1 restricted, 1 conditional	tag:GetResources

CloudFormation: 6 actions

cloudformation:DescribeStackDriftDetectionStatus (Read)
cloudformation:DescribeStackEvents (Read)
cloudformation:DescribeStackResources (Read)
cloudformation:DescribeStacks (List)
cloudformation:ListStacks (List)
cloudformation:ValidateTemplate (Read)

EC2: 11 actions

ec2:DescribeImages (List)
ec2:DescribeInstances (List)
ec2:DescribeInternetGateways (List)
ec2:DescribeKeyPairs (List)
ec2:DescribeNatGateways (List)
ec2:DescribeRouteTables (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeSubnets (List)
ec2:DescribeVpcs (List)
ec2:StartInstances (Write)
ec2:StopInstances (Write)

IAM: 6 actions

iam:GetInstanceProfile (Read)
iam:GetRole (Read)
iam:GetRolePolicy (Read)
iam:ListAttachedRolePolicies (List)
iam:ListRolePolicies (List)
iam:PassRole (Write)

KMS: 3 actions

kms:Decrypt (Write)
kms:Encrypt (Write)
kms:GenerateDataKey (Write)

CloudWatch Logs: 4 actions

logs:CreateLogGroup (Write)
logs:CreateLogStream (Write)
logs:PutLogEvents (Write)
logs:PutRetentionPolicy (Write)

EventBridge Scheduler: 7 actions

scheduler:CreateSchedule (Write)
scheduler:DeleteSchedule (Write)
scheduler:GetSchedule (Read)
scheduler:GetScheduleGroup (Read)
scheduler:ListScheduleGroups (List)
scheduler:ListSchedules (List)
scheduler:UpdateSchedule (Write)

Secrets Manager: 3 actions

secretsmanager:DescribeSecret (Read)
secretsmanager:GetSecretValue (Read)
secretsmanager:ListSecrets (List)

SQS: 1 actions

sqs:SendMessage (Write)

Systems Manager: 7 actions

ssm:DescribeInstanceInformation (Read)
ssm:DescribeSessions (List)
ssm:GetCommandInvocation (Read)
ssm:ListCommandInvocations (List)
ssm:ListCommands (List)
ssm:SendCommand (Write)
ssm:StartSession (Write)

Resource Group Tagging: 1 actions

tag:GetResources (Read)

Data-plane actions (4)

By access level: 1 List, 1 Read, 2 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
S3	4 of 25	1 List, 1 Read, 2 Write; 4 restricted, 4 conditional	s3:DeleteObject, s3:GetObject, s3:ListBucket, s3:PutObject

S3: 4 actions

s3:DeleteObject (Write)
s3:GetObject (Read)
s3:ListBucket (List)
s3:PutObject (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 18 write, tagging or permissions-management actions, short of full control of any service.
Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CFNRead",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:DescribeStackDriftDetectionStatus"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/atx-*/*",
        "arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*",
        "arn:aws:cloudformation:*:*:stack/AtxDispatcherStack/*"
      ]
    },
    {
      "Sid": "CFNValidateTemplate",
      "Effect": "Allow",
      "Action": "cloudformation:ValidateTemplate",
      "Resource": "*"
    },
    {
      "Sid": "EC2Desc",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeImages",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeRouteTables",
        "ec2:DescribeNatGateways",
        "ec2:DescribeInternetGateways"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "EC2PowerState",
      "Effect": "Allow",
      "Action": [
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/atx-remote-infra": "true"
        }
      }
    },
    {
      "Sid": "SSMRead",
      "Effect": "Allow",
      "Action": [
        "ssm:GetCommandInvocation",
        "ssm:ListCommands",
        "ssm:ListCommandInvocations",
        "ssm:DescribeInstanceInformation",
        "ssm:DescribeSessions"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SSMTgt",
      "Effect": "Allow",
      "Action": [
        "ssm:SendCommand",
        "ssm:StartSession"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringEquals": {
          "ssm:resourceTag/atx-remote-infra": "true"
        }
      }
    },
    {
      "Sid": "SSMDocs",
      "Effect": "Allow",
      "Action": "ssm:SendCommand",
      "Resource": "arn:aws:ssm:*::document/AWS-RunShellScript"
    },
    {
      "Sid": "S3Data",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::atx-source-code-*",
        "arn:aws:s3:::atx-source-code-*/*",
        "arn:aws:s3:::atx-ct-output-*",
        "arn:aws:s3:::atx-ct-output-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "KMSEncryptDecrypt",
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "ForAnyValue:StringLike": {
          "kms:ResourceAliases": [
            "alias/atx-encryption-key",
            "alias/atx-encryption-key-*"
          ]
        }
      }
    },
    {
      "Sid": "CmodCustomerLogGroupManagement",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:PutRetentionPolicy"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CmodCustomerLogStreamWrite",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization:log-stream:local/*",
        "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization:log-stream:ec2/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SM",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:atx/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SMList",
      "Effect": "Allow",
      "Action": "secretsmanager:ListSecrets",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SchedLifecycle",
      "Effect": "Allow",
      "Action": [
        "scheduler:CreateSchedule",
        "scheduler:DeleteSchedule",
        "scheduler:GetSchedule",
        "scheduler:UpdateSchedule"
      ],
      "Resource": [
        "arn:aws:scheduler:*:*:schedule/atx-ct/*",
        "arn:aws:scheduler:*:*:schedule/atx-ct-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SchedGroupRead",
      "Effect": "Allow",
      "Action": "scheduler:GetScheduleGroup",
      "Resource": [
        "arn:aws:scheduler:*:*:schedule-group/atx-ct",
        "arn:aws:scheduler:*:*:schedule-group/atx-ct-*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SchedList",
      "Effect": "Allow",
      "Action": [
        "scheduler:ListSchedules",
        "scheduler:ListScheduleGroups"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IAMPassEC2InstanceRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/atx-transform-role",
        "arn:aws:iam::*:role/atx-transform-role-*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ec2.amazonaws.com",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IAMPassSchedulerRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AtxSchedulerInvocationRole",
        "arn:aws:iam::*:role/AtxSchedulerInvocationRole-*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "scheduler.amazonaws.com",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IAMReadRoles",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListAttachedRolePolicies",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/atx-*",
        "arn:aws:iam::*:role/Atx*",
        "arn:aws:iam::*:role/ATX*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IAMReadInstanceProfile",
      "Effect": "Allow",
      "Action": "iam:GetInstanceProfile",
      "Resource": [
        "arn:aws:iam::*:instance-profile/atx-*",
        "arn:aws:iam::*:instance-profile/Atx*",
        "arn:aws:iam::*:instance-profile/ATX*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "TagGetATXStacks",
      "Effect": "Allow",
      "Action": "tag:GetResources",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CFNListStacksForDetect",
      "Effect": "Allow",
      "Action": "cloudformation:ListStacks",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SQSEnqueueToDispatcher",
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:*:*:atx-dispatcher-queue",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-10-22. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2

Terraform

resource "aws_iam_role_policy_attachment" "awstransforminfrastructureexecutoraccessec2" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSTransformInfrastructureExecutorAccessEC2"),
);

Sources

Pending editorial review. No editorial sources are listed yet.