Amazon Web Services
Amazon · aws · v1
- Hosts
- *.amazonaws.com
- Credential type
- aws-sigv4
- Placed in
- Authorization
- Default profile
- prod
Classification
| When | Class |
|---|---|
| ^sts(\.[a-z0-9-]+)?\.amazonaws\.com$ ?Action=^GetCallerIdentity$ | read |
| ^sts(\.[a-z0-9-]+)?\.amazonaws\.com$ Action=^GetCallerIdentity$ | read |
| ^sts(\.[a-z0-9-]+)?\.amazonaws\.com$ | destructivereturns a credential · always asksThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| X-Amz-Target: (?i)(^|[._])CreateAccessKey$ | destructivereturns a credential · always asksThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| ?Action=^CreateAccessKey$ | destructivereturns a credential · always asksThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| Action=^CreateAccessKey$ | destructivereturns a credential · always asksThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| X-Amz-Target: (?i)(^|[._])GetSecretValue$ | destructivereturns a credentialThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| X-Amz-Target: (?i)(^|[._])GetParameters?$ $.WithDecryption ~ ^true$ | destructivereturns a credentialThis path returns a credential of its own. It takes the destructive class and it is refused until you allow it. |
| X-Amz-Target: (?i)(^|[._])CreateAccount$ | writealways asks · spends money |
| ?Action=^CreateAccount$ | writealways asks · spends money |
| Action=^CreateAccount$ | writealways asks · spends money |
| X-Amz-Target: (?i)(^|[._])CreateUser$ | writealways asks |
| ?Action=^CreateUser$ | writealways asks |
| Action=^CreateUser$ | writealways asks |
| POST (^|\.)s3[.-] ?delete=^.*$ | destructive |
| X-Amz-Target: (?i)(^|[._])(Delete|Terminate|Remove|Revoke|Detach|Disable|Stop|Cancel)[A-Za-z]*$ | destructive |
| ?Action=^(Delete|Terminate|Remove|Revoke|Detach|Disable|Stop|Cancel)[A-Za-z]*$ | destructive |
| Action=^(Delete|Terminate|Remove|Revoke|Detach|Disable|Stop|Cancel)[A-Za-z]*$ | destructive |
| X-Amz-Target: (?i)(^|[._])(Describe|List|Get|Query|Scan|Head|BatchGet)[A-Za-z]*$ | read |
| ?Action=^(Describe|List|Get|Query|Scan|Head|BatchGet)[A-Za-z]*$ | read |
| Action=^(Describe|List|Get|Query|Scan|Head|BatchGet)[A-Za-z]*$ | read |
Scope we recommend
- a dedicated IAM user with a policy limited to the services the agent needs
- never iam:* or organizations:*
What it costs
A new member account starts billing against the organization's payer immediately.
Imported from
- access_key_id: AWS_ACCESS_KEY_ID
- secret_access_key: AWS_SECRET_ACCESS_KEY
- session_token: AWS_SESSION_TOKEN