AWS datazone: DataZone subscription target actions authorized at account level

Service: datazone · 2026-10-08 · Security-related high

File: datazone/latest/userguide/use-your-own-role.md · Type: authz

Summary

Adds a warning that CreateSubscriptionTarget, UpdateSubscriptionTarget, and DeleteSubscriptionTarget are authorized at the AWS account level, cannot be scoped below Resource:"*", and should be granted only to trusted administrative principals.

Security assessment

The added text explicitly documents an authorization weakness: these actions cannot be scoped below Resource:"*" and any principal with the IAM action can modify any project's subscription targets including authorizedPrincipals, which controls access grants. This is concrete security guidance about a privilege/authorization risk.

Evidence

    * `CreateSubscriptionTarget`, `UpdateSubscriptionTarget`, and `DeleteSubscriptionTarget` are authorized at the AWS account level. The caller must be in the same AWS account as the environment that owns the subscription target, but does not have to be an owner or a contributor of the project that owns it. Any principal in the associated account that holds the corresponding IAM action can therefore create, modify, or delete any project's subscription targets, including `authorizedPrincipals`, which determines the principals that Amazon DataZone grants access to when it fulfills a subscription. These actions cannot be scoped below `Resource: "*"` in an IAM identity policy and should therefore be granted only to trusted administrative principals.

Diff

diff --git a/datazone/latest/userguide/use-your-own-role.md b/datazone/latest/userguide/use-your-own-role.md
index c088be2..f765b40 100644
--- a//datazone/latest/userguide/use-your-own-role.md
+++ b//datazone/latest/userguide/use-your-own-role.md
@@ -75,0 +76,2 @@ Example of subscription target for Amazon Redshift:
+    * `CreateSubscriptionTarget`, `UpdateSubscriptionTarget`, and `DeleteSubscriptionTarget` are authorized at the AWS account level. The caller must be in the same AWS account as the environment that owns the subscription target, but does not have to be an owner or a contributor of the project that owns it. Any principal in the associated account that holds the corresponding IAM action can therefore create, modify, or delete any project's subscription targets, including `authorizedPrincipals`, which determines the principals that Amazon DataZone grants access to when it fulfills a subscription. These actions cannot be scoped below `Resource: "*"` in an IAM identity policy and should therefore be granted only to trusted administrative principals.
+