AI & Machine Learning: Admin policies
Machine learning platforms, generative AI and AI services.
27 AWS managed policies. 2 have reviewed guidance; the rest have authoritative permission data pending editorial review.
User access (24)
SageMaker (3)
- AmazonSageMakerFullAccessAdmin
Provides full access to Amazon SageMaker via the AWS Management Console and SDK. Also provides select access to related services (e.g., S3, ECR, CloudWatch Logs).
- SageMakerStudioAdminIAMDefaultExecutionPolicyAdmin
Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in your account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.
- SageMakerStudioUserIAMDefaultExecutionPolicyAdmin
Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in the local account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.
Bedrock (1)
- AmazonBedrockFullAccessAdmin
Provides full access to Amazon Bedrock as well as limited access to related services that are required by it
Lookout Vision (2)
- AmazonLookoutVisionConsoleFullAccessAdmin
Provides full access to Amazon Lookout for Vision and scoped access to required service and console dependencies.
- AmazonLookoutVisionFullAccessAdmin
Provides full access to Amazon Lookout for Vision and scoped access to required dependencies.
Lex (1)
- AmazonLexFullAccessAdmin
Provides full access to Amazon Lex via the AWS Management Console. Also provides access to create Lex Service Linked Roles and grant Lex permissions to invoke a limited set of Lambda functions.
AI Operations (1)
- AIOpsConsoleAdminPolicyAdmin
Grants full access to Amazon AI Operations service and its required permissions via AWS console. It also includes permissions to use identity-aware console sessions.
Bedrock Mantle (1)
- AmazonBedrockMantleFullAccessAdmin
Provides full access to Amazon Bedrock Mantle as well as limited access to related services that are required by it
Comprehend (1)
- ComprehendFullAccessAdmin
Provides full access to Amazon Comprehend.
Kendra (1)
- AmazonKendraFullAccessAdmin
Provides full access to Amazon Kendra via the AWS Management Console.
Lookout for Equipment (1)
- AmazonLookoutEquipmentFullAccessAdmin
Provides full access to Amazon Lookout for Equipment operations
Lookout Metrics (1)
- AmazonLookoutMetricsFullAccessAdmin
Gives access to all actions for Amazon Lookout for Metrics
Machine Learning (1)
- AmazonMachineLearningFullAccessAdmin
Provides full access to Amazon Machine Learning resources.
Rekognition (1)
- AmazonRekognitionFullAccessAdmin
Access to all Amazon Rekognition APIs
Transcribe (1)
- AmazonTranscribeFullAccessAdmin
Provides full access to Amazon Transcribe operations
Translate (1)
- TranslateFullAccessAdmin
Provides full access to Amazon Translate.
Other services (7)
- AmazonCognitoUnAuthedIdentitiesSessionPolicyAdmin
This policy defines the set of permissions allowed for unauthenticated identities for Cognito Identity Pools. This policy is not intended to be used as a stand alone permission policy. It is used as a guardrail against overly permissive pol…
- AmazonConnectVoiceIDFullAccessAdmin
Provides full access to Amazon Connect Voice ID
- AmazonForecastFullAccessAdmin
Gives access to all actions for Amazon Forecast
- AmazonFraudDetectorFullAccessPolicyAdmin
Gives access to all actions for Amazon Fraud Detector
- AmazonTextractFullAccessAdmin
Access to all Amazon Textract APIs
- AnthropicFullAccessAdmin
Provides full access to Claude Platform on AWS
- ComprehendMedicalFullAccessAdmin
Provides full access to Amazon Comprehend Medical
Service roles (3)
SageMaker (2)
- AmazonSageMakerGeospatialFullAccessAdmin
This policy grants permissions that allow full access to Amazon SageMaker Geospatial through the AWS Management Console and SDK.
- AWSDeepRacerServiceRolePolicyAdmin
Allows DeepRacer to create required resources and call AWS services on your behalf.
Other services (1)
- AmazonPersonalizeFullAccessAdmin
Provides full access to Amazon Personalize via the AWS Management Console and SDK. Also provides select access to related services (e.g., S3, CloudWatch).
Also relevant to AI & Machine Learning (10)
- AdministratorAccessHigh privilegeAdmin
Provides full access to AWS services and resources.
- AIDevOpsAgentActionsPolicyHigh privilegeAdmin
Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events.
- AmazonBraketFullAccessAdmin
Provides full access to Amazon Braket via the AWS Management Console and SDK. Also provides access to related services (e.g., S3, logs).
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundaryAdmin
The AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary policy is the list of permissions that are permitted on an execution role created in a SageMaker environment provisioned by Amazon DataZone.
- AWSCODAPermissionsBoundaryHigh privilegeAdmin
AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.
- DataScientistHigh privilegeAdmin
Grants permissions to AWS data analytics services.
- PowerUserAccessHigh privilegeAdmin
Provides full access to AWS services and resources, but does not allow management of Users and groups.
- SageMakerStudioAdminIAMPermissiveExecutionPolicyHigh privilegeAdmin
Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch L…
- SageMakerStudioProjectUserRolePermissionsBoundaryAdmin
Amazon SageMaker creates IAM roles for Projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the boundary of their permissions.
- SageMakerStudioUserIAMPermissiveExecutionPolicyHigh privilegeAdmin
Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in your account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of Sag…