Skip to main content
IAM Policy Map

Changelog, November 2026

25changes detected in November 2026, newest first.

  1. Actions added: agentaccess-mcp

    Detected . 2 actions added to agentaccess-mcp. (2 added, 0 removed)

    Actions added (2)

    • agentaccess-mcp:GetCurrentUser
    • agentaccess-mcp:SwitchUser

  2. Actions added: airflow-serverless

    Detected . 1 action added to airflow-serverless. (1 added, 0 removed)

    Actions added (1)

    • airflow-serverless:CreateAirflowUiUrl

  3. Actions added: appstream

    Detected . 1 action added to appstream. (1 added, 0 removed)

    Actions added (1)

    • appstream:UpdateImageBuilder

  4. Actions added: cloudformation

    Detected . 2 actions added to cloudformation. (2 added, 0 removed)

    Actions added (2)

    • cloudformation:RemoveAlias
    • cloudformation:SetAlias

  5. Actions added: cloudwatch

    Detected . 4 actions added to cloudwatch. (4 added, 0 removed)

    Actions added (4)

    • cloudwatch:DeleteMetricDataQueryDefinition
    • cloudwatch:GetMetricDataQueryDefinition
    • cloudwatch:ListMetricDataQueryDefinitions
    • cloudwatch:PutMetricDataQueryDefinition

  6. Actions added: cognito-idp

    Detected . 8 actions added to cognito-idp. (8 added, 0 removed)

    Actions added (8)

    • cognito-idp:AdminListUserSessions
    • cognito-idp:AdminRevokeUserSession
    • cognito-idp:GetUserPoolClientSessionConfiguration
    • cognito-idp:GetUserPoolSessionConfiguration
    • cognito-idp:ListUserSessions
    • cognito-idp:RevokeUserSession
    • cognito-idp:SetUserPoolClientSessionConfiguration
    • cognito-idp:SetUserPoolSessionConfiguration

  7. Actions added: guardduty

    Detected . 1 action added to guardduty. (1 added, 0 removed)

    Actions added (1)

    • guardduty:ListInvestigationRecords

  8. Actions added: odb

    Detected . 5 actions added to odb. (5 added, 0 removed)

    Actions added (5)

    • odb:AssociateVirtualMachinesToCloudVmCluster
    • odb:DisassociateVirtualMachinesFromCloudVmCluster
    • odb:UpdateCloudAutonomousVmCluster
    • odb:UpdateCloudExadataInfrastructureStorageCapacity
    • odb:UpdateCloudVmCluster

  9. Actions added: secretsmanager

    Detected . 4 actions added to secretsmanager. (4 added, 0 removed)

    Actions added (4)

    • secretsmanager:AcceptCrossAccountReplication
    • secretsmanager:AssociateCrossAccountReplica
    • secretsmanager:DisassociateCrossAccountReplica
    • secretsmanager:ListResourcePolicies

  10. Actions added: securityhub

    Detected . 2 actions added to securityhub. (2 added, 0 removed)

    Actions added (2)

    • securityhub:GetCSPMOrganizationsImportStatus
    • securityhub:PutCSPMOrganizationsImportStatus

  11. Actions added: transform-custom

    Detected . 4 actions added to transform-custom. (4 added, 0 removed)

    Actions added (4)

    • transform-custom:ContributeKnowledgeItems
    • transform-custom:DeleteResourcePolicy
    • transform-custom:GetResourcePolicy
    • transform-custom:PutResourcePolicy

  12. Actions added: user-subscriptions

    Detected . 2 actions added to user-subscriptions. (2 added, 0 removed)

    Actions added (2)

    • user-subscriptions:GetOverageConfig
    • user-subscriptions:ListUsagesAndLimits

  13. Policy added: AWSCODAServiceRolePolicy

    Detected . Added AWSCODAServiceRolePolicy (v1).

  14. Policy added: AWSNetworkFirewallIGWServiceRolePolicy

    Detected . Added AWSNetworkFirewallIGWServiceRolePolicy (v1).

  15. Policy added: AWSNotificationsContactAssociationsServiceLinkedRolePolicy

    Detected . Added AWSNotificationsContactAssociationsServiceLinkedRolePolicy (v1).

  16. Policy added: AWSPartnerCentralBusinessPlanManagement

    Detected . Added AWSPartnerCentralBusinessPlanManagement (v1).

  17. Policy added: AmazonBioDiscoveryServiceLinkedRolePolicy

    Detected . Added AmazonBioDiscoveryServiceLinkedRolePolicy (v1).

  18. Policy updated: AIDevOpsAgentAccessPolicy

    Detected . AIDevOpsAgentAccessPolicy: default version v14 to v15, 11 actions added. (11 added, 0 removed)

    Actions added (11)

    • cloudwatch:GetAlert
    • cloudwatch:GetContextGraph
    • cloudwatch:GetIntelligenceConfiguration
    • cloudwatch:GetRecords
    • cloudwatch:GetSpace
    • cloudwatch:GetTelemetryQueryResults
    • cloudwatch:StartTelemetryQuery
    • cloudwatch:StartTelemetryQuerySession
    • cloudwatch:StopTelemetryQuery
    • cloudwatch:StopTelemetryQuerySession

    and 1 more, see the version history

    Version history

  19. Policy updated: AIDevOpsOperatorAppAccessPolicy

    Detected . AIDevOpsOperatorAppAccessPolicy: default version v12 to v13, 5 actions added. (5 added, 0 removed)

    Actions added (5)

    • aidevops:GetKnowledgeGraph
    • aidevops:GetPlan
    • aidevops:ListAgentSpaceMetrics
    • aidevops:ListAssetChanges
    • aidevops:StopPlan

    Version history

  20. Policy updated: AWSTransformServerMigrationAgentPolicy

    Detected . AWSTransformServerMigrationAgentPolicy: default version v3 to v4, 17 actions added. (17 added, 0 removed)

    Actions added (17)

    • cloudwatch:GetMetricData
    • ec2:DescribeInstanceTypeOfferings
    • elasticloadbalancing:DescribeTags
    • elasticloadbalancing:DescribeTargetGroups
    • elasticloadbalancing:DescribeTargetHealth
    • elasticloadbalancing:RegisterTargets
    • mgn:CreateRemoteSourceAction
    • mgn:DeleteRemoteSourceAction
    • mgn:GetLaunchConfigurationDefaults
    • mgn:ListRemoteSourceActionInvocationResults

    and 7 more, see the version history

    Version history

  21. Policy updated: AmazonCognitoIdpServiceRolePolicy

    Detected . AmazonCognitoIdpServiceRolePolicy: default version v1 to v2, 8 actions added. (8 added, 0 removed)

    Actions added (8)

    • secretsmanager:DeleteSecret
    • secretsmanager:DescribeSecret
    • secretsmanager:PutSecretValue
    • secretsmanager:RemoveRegionsFromReplication
    • secretsmanager:ReplicateSecretToRegions
    • secretsmanager:RestoreSecret
    • secretsmanager:RotateSecret
    • secretsmanager:UpdateSecretVersionStage

    Version history

  22. Policy updated: AuroraDsqlServiceLinkedRolePolicy

    Detected . AuroraDsqlServiceLinkedRolePolicy: default version v6 to v7, 4 actions added. (4 added, 0 removed)

    Actions added (4)

    • logs:CreateLogGroup
    • logs:CreateLogStream
    • logs:PutLogEvents
    • logs:PutRetentionPolicy

    Version history

  23. Policy updated: CloudWatchOmniSpaceAccessPolicy

    Detected . CloudWatchOmniSpaceAccessPolicy: default version v2 to v3, 1 action added. (1 added, 0 removed)

    Actions added (1)

    • cloudwatch:GetSpaceDataAccess

    Version history

  24. Policy updated: CloudWatchReadOnlyAccess

    Detected . CloudWatchReadOnlyAccess: default version v26 to v27, 1 action added. (1 added, 0 removed)

    Actions added (1)

    • cloudwatch:DetectGroupOutliers

    Version history

  25. Policy updated: SageMakerStudioDomainExecutionRolePolicy

    Detected . SageMakerStudioDomainExecutionRolePolicy: default version v25 to v26, 3 actions added. (3 added, 0 removed)

    Actions added (3)

    • datazone:CreateNotificationPreference
    • datazone:GetNotificationPreference
    • datazone:UpdateNotificationPreference

    Version history