actions.yaml

CredentialExposure:
  Actions:
  - appsync:ListApiKeys
  - athena:GetSession
  - chatbot:GetMicrosoftTeamsOauthParameters
  - chatbot:GetSlackOauthParameters
  - chime:CreateApiKey
  - cloud9:CreateEnvironmentSSH
  - cloud9:CreateEnvironmentToken
  - codeartifact:GetAuthorizationToken
  - codepipeline:PollForJobs
  - cognito-identity:GetCredentialsForIdentity
  - cognito-identity:GetOpenIdToken
  - cognito-identity:GetOpenIdTokenForDeveloperIdentity
  - cognito-idp:DescribeUserPoolClient
  - cognito-idp:GetUserAttributeVerificationCode
  - connect:GetFederationToken
  - connect:ListSecurityKeys
  - ec2:GetPasswordData
  - ec2-instance-connect:SendSSHPublicKey
  - ecr-public:GetAuthorizationToken
  - ecr:GetAuthorizationToken
  - gamelift:GetComputeAuthToken
  - gamelift:GetGameSessionLogUrl
  - gamelift:GetInstanceAccess
  - gamelift:RequestUploadCredentials
  - iam:CreateAccessKey
  - iam:CreateLoginProfile
  - iam:CreateServiceSpecificCredential
  - iam:ResetServiceSpecificCredential
  - iam:UpdateAccessKey
  - lightsail:DownloadDefaultKeyPair
  - lightsail:GetBucketAccessKeys
  - lightsail:GetKeyPair
  - lightsail:GetKeyPairs
  - lightsail:GetRelationalDatabaseMasterUserPassword
  - mediapackage:RotateChannelCredentials
  - mediapackage:RotateIngestEndpointCredentials
  - rds-db:connect
  - redshift:GetClusterCredentials
  - s3:GetDataAccess
  - snowball:GetJobUnlockCode
  - sso-directory:ListBearerTokens
  - storagegateway:DescribeChapCredentials
  - sts:AssumeRole
  - sts:AssumeRoleWithSAML
  - sts:AssumeRoleWithWebIdentity
  - sts:GetFederationToken
  - sts:GetSessionToken
  - waf-regional:GetChangeToken
  - waf:GetChangeToken

DataAccess:
  Actions:
  - aoss:APIAccessAll
  - aoss:DashboardsAccessAll
  - appsync:GetDataSource
  - appsync:GetFunction
  - athena:GetQueryExecution
  - athena:GetQueryResults
  - athena:GetQueryResultsStream
  - cassandra:Select
  - chatbot:DescribeSlackChannels
  - chatbot:DescribeSlackUserIdentities
  - chatbot:ListMicrosoftTeamsConfiguredTeams
  - chatbot:ListMicrosoftTeamsUserIdentities
  - chime:GetAttendee
  - chime:GetChannelMessage
  - chime:GetMeeting
  - chime:GetMeetingDetail
  - chime:GetRoom
  - chime:GetUser
  - chime:GetUserActivityReportData
  - chime:GetUserByEmail
  - chime:GetUserSettings
  - chime:ListAttendees
  - chime:ListMeetingEvents
  - chime:ListMeetings
  - chime:ListUsers
  - cleanrooms:GetProtectedQuery
  - cloudformation:GetTemplate
  - cloudfront:GetFunction
  - cloudtrail:GetQueryResults
  - cloudtrail:LookupEvents
  - codeartifact:GetPackageVersionAsset
  - codeartifact:GetPackageVersionReadme
  - codeartifact:ReadFromRepository
  - codebuild:BatchGetReportGroups
  - codebuild:BatchGetReports
  - codecommit:BatchGetCommits
  - codecommit:BatchGetPullRequests
  - codecommit:BatchGetRepositories
  - codecommit:DescribeMergeConflicts
  - codecommit:DescribePullRequestEvents
  - codecommit:GetApprovalRuleTemplate
  - codecommit:GetBlob
  - codecommit:GetBranch
  - codecommit:GetComment
  - codecommit:GetCommentReactions
  - codecommit:GetCommentsForComparedCommit
  - codecommit:GetCommentsForPullRequest
  - codecommit:GetCommit
  - codecommit:GetCommitHistory
  - codecommit:GetCommitsFromMergeBase
  - codecommit:GetDifferences
  - codecommit:GetFile
  - codecommit:GetFolder
  - codecommit:GetMergeCommit
  - codecommit:GetMergeConflicts
  - codecommit:GetMergeOptions
  - codecommit:GetObjectIdentifier
  - codecommit:GetPullRequest
  - codecommit:GetPullRequestApprovalStates
  - codecommit:GetPullRequestOverrideState
  - codecommit:GetReferences
  - codecommit:GetTree
  - codecommit:GitPull
  - codeguru-profiler:GetRecommendations
  - codeguru-reviewer:DescribeCodeReview
  - codeguru-reviewer:DescribeRecommendationFeedback
  - codepipeline:GetPipelineExecution
  - cognito-identity:LookupDeveloperIdentity
  - cognito-idp:AdminGetDevice
  - cognito-idp:AdminGetUser
  - cognito-idp:AdminListDevices
  - cognito-idp:AdminListGroupsForUser
  - cognito-idp:AdminListUserAuthEvents
  - cognito-idp:GetDevice
  - cognito-idp:GetGroup
  - cognito-idp:GetUser
  - cognito-idp:ListUsers
  - cognito-idp:ListDevices
  - cognito-idp:ListGroups
  - cognito-sync:ListRecords
  - cognito-sync:QueryRecords
  - connect:ListUsers
  - datapipeline:QueryObjects
  - dax:BatchGetItem
  - dax:GetItem
  - dax:Query
  - dax:Scan
  - dynamodb:BatchGetItem
  - dynamodb:GetItem
  - dynamodb:GetRecords
  - dynamodb:Query
  - dynamodb:Scan
  - ecr:GetDownloadUrlForLayer
  - es:ESHttpDelete
  - es:ESHttpGet
  - es:ESHttpHead
  - es:ESHttpPatch
  - es:ESHttpPost
  - es:ESHttpPut
  - gamelift:GetInstanceAccess
  - healthlake:ReadResource
  - healthlake:SearchWithGet
  - healthlake:SearchWithPost
  - kendra:Query
  - kinesis:GetRecords
  - kinesisvideo:GetImages
  - kinesisvideo:GetMedia
  - kms:CreateGrant
  - lambda:GetFunction
  - lambda:GetLayerVersion
  - lightsail:GetContainerImages
  - logs:GetLogEvents
  - logs:GetLogRecord
  - logs:GetQueryResults
  - logs:Unmask
  - macie2:GetFindings
  - mediastore:GetObject
  - qldb:GetBlock
  - rds:DownloadCompleteDBLogFile
  - rds:DownloadDBLogFilePortion
  - robomaker:GetWorldTemplateBody
  - s3-object-lambda:GetObject
  - s3-object-lambda:GetObjectVersion
  - s3-object-lambda:ListBucket
  - s3:GetObject
  - s3:GetObjectVersion
  - sagemaker:Search
  - sdb:Select
  - serverlessrepo:GetApplication
  - serverlessrepo:GetCloudFormationTemplate
  - sqs:ReceiveMessage
  - ssm:GetDocument
  - ssm:GetParameter
  - ssm:GetParameterHistory
  - ssm:GetParameters
  - ssm:GetParametersByPath
  - sso-directory:DescribeGroup
  - sso-directory:DescribeUser
  - sso-directory:SearchGroups
  - sso-directory:SearchUsers
  - sso:SearchGroups
  - sso:SearchUsers
  - support:DescribeAttachment
  - support:DescribeCommunications
  - wafv2:GetSampledRequests
  - workdocs:GetDocument
  - workdocs:GetDocumentPath
  - workdocs:GetDocumentVersion
  - workmail:ListGroupMembers
  - workmail:ListGroups
  - workmail:ListUsers

PrivEsc:
  Actions:
  - codestar:AssociateTeamMember
  - codestar:CreateProject
  - ec2-instance-connect:SendSSHPublicKey
  - glue:UpdateDevEndpoint
  - iam:AddUserToGroup
  - iam:AttachGroupPolicy
  - iam:AttachRolePolicy
  - iam:AttachUserPolicy
  - iam:CreateAccessKey
  - iam:CreateLoginProfile
  - iam:CreatePolicyVersion
  - iam:CreateServiceLinkedRole
  - iam:CreateVirtualMFADevice
  - iam:DeleteRolePermissionsBoundary
  - iam:DeleteUserPermissionsBoundary
  - iam:EnableMFADevice
  - iam:PassRole
  - iam:PutGroupPolicy
  - iam:PutRolePermissionsBoundary
  - iam:PutRolePolicy
  - iam:PutUserPermissionsBoundary
  - iam:PutUserPolicy
  - iam:ResyncMFADevice
  - iam:SetDefaultPolicyVersion
  - iam:UpdateAssumeRolePolicy
  - iam:UpdateLoginProfile
  - kms:CreateGrant

ResourceExposure:
  Actions:
  - acm-pca:CreatePermission
  - acm-pca:DeletePermission
  - acm-pca:DeletePolicy
  - acm-pca:PutPolicy
  - apigateway:UpdateRestApiPolicy
  - backup:DeleteBackupVaultAccessPolicy
  - backup:PutBackupVaultAccessPolicy
  - chime:DeleteVoiceConnectorTerminationCredentials
  - chime:PutVoiceConnectorTerminationCredentials
  - cloudformation:SetStackPolicy
  - cloudsearch:UpdateServiceAccessPolicies
  - codeartifact:DeleteDomainPermissionsPolicy
  - codeartifact:DeleteRepositoryPermissionsPolicy
  - codebuild:DeleteResourcePolicy
  - codebuild:DeleteSourceCredentials
  - codebuild:ImportSourceCredentials
  - codebuild:PutResourcePolicy
  - codeguru-profiler:PutPermission
  - codeguru-profiler:RemovePermission
  - codestar:AssociateTeamMember
  - codestar:CreateProject
  - codestar:DeleteProject
  - codestar:DisassociateTeamMember
  - codestar:UpdateTeamMember
  - cognito-identity:CreateIdentityPool
  - cognito-identity:DeleteIdentities
  - cognito-identity:DeleteIdentityPool
  - cognito-identity:GetId
  - cognito-identity:MergeDeveloperIdentities
  - cognito-identity:SetIdentityPoolRoles
  - cognito-identity:UnlinkDeveloperIdentity
  - cognito-identity:UnlinkIdentity
  - cognito-identity:UpdateIdentityPool
  - deeplens:AssociateServiceRoleToAccount
  - ds:CreateConditionalForwarder
  - ds:CreateDirectory
  - ds:CreateMicrosoftAD
  - ds:CreateTrust
  - ds:ShareDirectory
  - ec2:CreateNetworkInterfacePermission
  - ec2:DeleteNetworkInterfacePermission
  - ec2:DisableImageBlockPublicAccess
  - ec2:ModifySnapshotAttribute
  - ec2:ModifyVpcEndpointServicePermissions
  - ec2:ResetSnapshotAttribute
  - ecr:DeleteRepositoryPolicy
  - ecr:SetRepositoryPolicy
  - elasticfilesystem:DeleteFileSystemPolicy
  - elasticfilesystem:PutFileSystemPolicy
  - elasticmapreduce:PutBlockPublicAccessConfiguration
  - es:CreateElasticsearchDomain
  - es:UpdateElasticsearchDomainConfig
  - glacier:AbortVaultLock
  - glacier:CompleteVaultLock
  - glacier:DeleteVaultAccessPolicy
  - glacier:InitiateVaultLock
  - glacier:SetDataRetrievalPolicy
  - glacier:SetVaultAccessPolicy
  - glue:DeleteResourcePolicy
  - glue:PutResourcePolicy
  - greengrass:AssociateServiceRoleToAccount
  - health:DisableHealthServiceAccessForOrganization
  - health:EnableHealthServiceAccessForOrganization
  - iam:AddClientIDToOpenIDConnectProvider
  - iam:AddRoleToInstanceProfile
  - iam:AddUserToGroup
  - iam:AttachGroupPolicy
  - iam:AttachRolePolicy
  - iam:AttachUserPolicy
  - iam:ChangePassword
  - iam:CreateAccessKey
  - iam:CreateAccountAlias
  - iam:CreateGroup
  - iam:CreateInstanceProfile
  - iam:CreateLoginProfile
  - iam:CreateOpenIDConnectProvider
  - iam:CreatePolicy
  - iam:CreatePolicyVersion
  - iam:CreateRole
  - iam:CreateSAMLProvider
  - iam:CreateServiceLinkedRole
  - iam:CreateServiceSpecificCredential
  - iam:CreateUser
  - iam:CreateVirtualMFADevice
  - iam:DeactivateMFADevice
  - iam:DeleteAccessKey
  - iam:DeleteAccountAlias
  - iam:DeleteAccountPasswordPolicy
  - iam:DeleteGroup
  - iam:DeleteGroupPolicy
  - iam:DeleteInstanceProfile
  - iam:DeleteLoginProfile
  - iam:DeleteOpenIDConnectProvider
  - iam:DeletePolicy
  - iam:DeletePolicyVersion
  - iam:DeleteRole
  - iam:DeleteRolePermissionsBoundary
  - iam:DeleteRolePolicy
  - iam:DeleteSAMLProvider
  - iam:DeleteServerCertificate
  - iam:DeleteServiceLinkedRole
  - iam:DeleteServiceSpecificCredential
  - iam:DeleteSigningCertificate
  - iam:DeleteSSHPublicKey
  - iam:DeleteUser
  - iam:DeleteUserPermissionsBoundary
  - iam:DeleteUserPolicy
  - iam:DeleteVirtualMFADevice
  - iam:DetachGroupPolicy
  - iam:DetachRolePolicy
  - iam:DetachUserPolicy
  - iam:EnableMFADevice
  - iam:PassRole
  - iam:PutGroupPolicy
  - iam:PutRolePermissionsBoundary
  - iam:PutRolePolicy
  - iam:PutUserPermissionsBoundary
  - iam:PutUserPolicy
  - iam:RemoveClientIDFromOpenIDConnectProvider
  - iam:RemoveRoleFromInstanceProfile
  - iam:RemoveUserFromGroup
  - iam:ResetServiceSpecificCredential
  - iam:ResyncMFADevice
  - iam:SetDefaultPolicyVersion
  - iam:SetSecurityTokenServicePreferences
  - iam:UpdateAccessKey
  - iam:UpdateAccountPasswordPolicy
  - iam:UpdateAssumeRolePolicy
  - iam:UpdateGroup
  - iam:UpdateLoginProfile
  - iam:UpdateOpenIDConnectProviderThumbprint
  - iam:UpdateRole
  - iam:UpdateRoleDescription
  - iam:UpdateSAMLProvider
  - iam:UpdateServerCertificate
  - iam:UpdateServiceSpecificCredential
  - iam:UpdateSigningCertificate
  - iam:UpdateSSHPublicKey
  - iam:UpdateUser
  - iam:UploadServerCertificate
  - iam:UploadSigningCertificate
  - iam:UploadSSHPublicKey
  - imagebuilder:PutComponentPolicy
  - imagebuilder:PutImagePolicy
  - imagebuilder:PutImageRecipePolicy
  - iot:AttachPolicy
  - iot:AttachPrincipalPolicy
  - iot:DetachPolicy
  - iot:DetachPrincipalPolicy
  - iot:SetDefaultAuthorizer
  - iot:SetDefaultPolicyVersion
  - iotsitewise:CreateAccessPolicy
  - iotsitewise:DeleteAccessPolicy
  - iotsitewise:UpdateAccessPolicy
  - kms:CreateGrant
  - kms:PutKeyPolicy
  - kms:RetireGrant
  - kms:RevokeGrant
  - lakeformation:BatchGrantPermissions
  - lakeformation:BatchRevokePermissions
  - lakeformation:GrantPermissions
  - lakeformation:PutDataLakeSettings
  - lakeformation:RevokePermissions
  - lambda:AddLayerVersionPermission
  - lambda:AddPermission
  - lambda:DisableReplication
  - lambda:EnableReplication
  - lambda:RemoveLayerVersionPermission
  - lambda:RemovePermission
  - license-manager:UpdateServiceSettings
  - lightsail:GetRelationalDatabaseMasterUserPassword
  - logs:DeleteResourcePolicy
  - logs:PutResourcePolicy
  - mediapackage:RotateIngestEndpointCredentials
  - mediastore:DeleteContainerPolicy
  - mediastore:PutContainerPolicy
  - opsworks:SetPermission
  - opsworks:UpdateUserProfile
  - quicksight:CreateAdmin
  - quicksight:CreateGroup
  - quicksight:CreateGroupMembership
  - quicksight:CreateIAMPolicyAssignment
  - quicksight:CreateUser
  - quicksight:DeleteGroup
  - quicksight:DeleteGroupMembership
  - quicksight:DeleteIAMPolicyAssignment
  - quicksight:DeleteUser
  - quicksight:DeleteUserByPrincipalId
  - quicksight:RegisterUser
  - quicksight:UpdateDashboardPermissions
  - quicksight:UpdateGroup
  - quicksight:UpdateIAMPolicyAssignment
  - quicksight:UpdateTemplatePermissions
  - quicksight:UpdateUser
  - ram:AcceptResourceShareInvitation
  - ram:AssociateResourceShare
  - ram:CreateResourceShare
  - ram:DeleteResourceShare
  - ram:DisassociateResourceShare
  - ram:EnableSharingWithAwsOrganization
  - ram:RejectResourceShareInvitation
  - ram:UpdateResourceShare
  - rds-db:connect
  - rds:AuthorizeDBSecurityGroupIngress
  - redshift:AuthorizeSnapshotAccess
  - redshift:CreateClusterUser
  - redshift:CreateSnapshotCopyGrant
  - redshift:JoinGroup
  - redshift:ModifyClusterIamRoles
  - redshift:RevokeSnapshotAccess
  - route53resolver:PutResolverRulePolicy
  - s3:BypassGovernanceRetention
  - s3:DeleteAccessPointPolicy
  - s3:DeleteBucketPolicy
  - s3:ObjectOwnerOverrideToBucketOwner
  - s3:PutAccessPointPolicy
  - s3:PutAccountPublicAccessBlock
  - s3:PutBucketAcl
  - s3:PutBucketPolicy
  - s3:PutBucketPublicAccessBlock
  - s3:PutObjectAcl
  - s3:PutObjectVersionAcl
  - secretsmanager:DeleteResourcePolicy
  - secretsmanager:PutResourcePolicy
  - secretsmanager:ValidateResourcePolicy
  - servicecatalog:CreatePortfolioShare
  - servicecatalog:DeletePortfolioShare
  - sns:AddPermission
  - sns:CreateTopic
  - sns:RemovePermission
  - sns:SetTopicAttributes
  - sqs:AddPermission
  - sqs:CreateQueue
  - sqs:RemovePermission
  - sqs:SetQueueAttributes
  - ssm:ModifyDocumentPermission
  - sso-directory:AddMemberToGroup
  - sso-directory:CreateAlias
  - sso-directory:CreateGroup
  - sso-directory:CreateUser
  - sso-directory:DeleteGroup
  - sso-directory:DeleteUser
  - sso-directory:DisableUser
  - sso-directory:EnableUser
  - sso-directory:RemoveMemberFromGroup
  - sso-directory:UpdateGroup
  - sso-directory:UpdatePassword
  - sso-directory:UpdateUser
  - sso-directory:VerifyEmail
  - sso:AssociateDirectory
  - sso:AssociateProfile
  - sso:CreateApplicationInstance
  - sso:CreateApplicationInstanceCertificate
  - sso:CreatePermissionSet
  - sso:CreateProfile
  - sso:CreateTrust
  - sso:DeleteApplicationInstance
  - sso:DeleteApplicationInstanceCertificate
  - sso:DeletePermissionSet
  - sso:DeletePermissionsPolicy
  - sso:DeleteProfile
  - sso:DisassociateDirectory
  - sso:DisassociateProfile
  - sso:ImportApplicationInstanceServiceProviderMetadata
  - sso:PutPermissionsPolicy
  - sso:StartSSO
  - sso:UpdateApplicationInstanceActiveCertificate
  - sso:UpdateApplicationInstanceDisplayData
  - sso:UpdateApplicationInstanceResponseConfiguration
  - sso:UpdateApplicationInstanceResponseSchemaConfiguration
  - sso:UpdateApplicationInstanceSecurityConfiguration
  - sso:UpdateApplicationInstanceServiceProviderConfiguration
  - sso:UpdateApplicationInstanceStatus
  - sso:UpdateDirectoryAssociation
  - sso:UpdatePermissionSet
  - sso:UpdateProfile
  - sso:UpdateSSOConfiguration
  - sso:UpdateTrust
  - storagegateway:DeleteChapCredentials
  - storagegateway:SetLocalConsolePassword
  - storagegateway:SetSMBGuestPassword
  - storagegateway:UpdateChapCredentials
  - waf-regional:DeletePermissionPolicy
  - waf-regional:PutPermissionPolicy
  - waf:DeletePermissionPolicy
  - waf:PutPermissionPolicy
  - wafv2:CreateWebACL
  - wafv2:DeletePermissionPolicy
  - wafv2:DeleteWebACL
  - wafv2:PutPermissionPolicy
  - wafv2:UpdateWebACL
  - worklink:UpdateDevicePolicyConfiguration
  - workmail:ResetPassword
  - workmail:ResetUserPassword
  - xray:PutEncryptionConfig