Skip to main content
IAM Policy Map
IAM Policy Map
Analytics: Switch between the hub and domains
MapList

Can change permissions or pass roles: 35 of 118 policies: 0 unrestricted, 35 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 70 of 118 policies: 45 write, 18 read only, 7 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Analytics policies

Data lakes, warehouses, streaming, search and business intelligence.

118 AWS managed policies. 16 have reviewed guidance; the rest have authoritative permission data pending editorial review. 12 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (51)

OpenSearch (5)

SageMaker (5)

  • AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundaryAdmin

    The AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary policy is the list of permissions that are permitted on an execution role created in a SageMaker environment provisioned by Amazon DataZone.

  • AWSGlueConsoleSageMakerNotebookFullAccessAdmin

    Provides full access to AWS Glue via the AWS Management Console and access to sagemaker notebook instances.

  • SageMakerStudioAdminIAMConsolePolicyAdmin

    Provides initial administrative and individual setup privileges for Amazon SageMaker Unified Studio via the AWS Management Console and SDK. Allows launching of SageMaker Unified Studio Portal.

  • SageMakerStudioFullAccessAdmin

    This policy provides full access to Amazon SageMaker Unified Studio via the Amazon SageMaker management console.

  • SageMakerStudioProjectUserRolePermissionsBoundaryAdmin

    Amazon SageMaker creates IAM roles for Projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the boundary of their permissions.

Kinesis (4)

DataZone (3)

  • AmazonDataZoneEnvironmentRolePermissionsBoundaryAdmin

    Amazon DataZone creates IAM roles for Environments to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneFullAccessAdmin

    Provides full access to Amazon DataZone via the AWS Management Console as well as limited access to related services that are required by it.

  • AmazonDataZoneProjectRolePermissionsBoundaryAdmin

    Amazon DataZone creates IAM roles for projects to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

MSK (3)

Clean Rooms (2)

  • AWSCleanRoomsFullAccessAdmin

    Allows full access to AWS Clean Rooms resources and access to related AWS services.

  • AWSCleanRoomsReadOnlyAccessAnalyst

    Allows read-only access to AWS Clean Rooms resources and read-only access to related AWS Glue and Amazon CloudWatch Logs resources.

Clean Rooms ML (2)

CloudSearch (2)

Data Exchange (2)

  • AWSDataExchangeFullAccessAdmin

    Grants full access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.

  • AWSDataExchangeReadOnlyReader

    Grants read-only access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK.

Data Firehose (2)

Data Pipeline (2)

  • AWSDataPipeline_FullAccessAdmin

    Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles.

  • AWSDataPipeline_PowerUserAdmin

    Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles.

EMR (2)

Entity Resolution (2)

Glue (2)

HealthImaging (2)

HealthLake (2)

Kinesis Analytics (2)

Omics (2)

  • AmazonOmicsFullAccessAdmin

    Provides full access to Amazon Omics and other required AWS services. This policy allows the user to view and accept RAM share invitations to access resources outside of the user's AWS account.

  • AmazonOmicsReadOnlyAccessReader

    Provide read only access to Amazon Omics

Other services (5)

  • AmazonAthenaFullAccessAdmin

    Provide full access to Amazon Athena and scoped access to the dependencies needed to enable querying, writing results, and data management.

  • AmazonRedshiftFullAccessAdmin

    Provides full access to Amazon Redshift via the AWS Management Console.

  • AwsGlueDataBrewFullAccessPolicyAdmin

    Provides full access to AWS Glue DataBrew via the AWS Management Console. Also provides select access to related services (e.g., S3, KMS, Glue).

  • AWSLakeFormationDataAdminAdmin

    Grants administrative access to AWS Lake Formation and related services, such as AWS Glue, to manage data lakes

  • QBusinessQuicksightPluginPolicyReader

    Grants permissions to QBusiness to call QuickSight APIs for the QuickSight plugin

Operator and limited (30)

SageMaker (5)

  • AmazonSageMakerCanvasDataPrepFullAccessOperator

    Provides full access to Amazon SageMaker resources and operations for data preparation in Canvas. The policy also provides select access to related services (e.g., S3, IAM, KMS, RDS, CloudWatch Logs, Redshift, Athena, Glue, EventBridge, Sec…

  • AmazonSageMakerPipelinesIntegrationsOperator

    This Amazon Managed Policy grants permissions commonly needed for use with Callback steps and Lambda steps in SageMaker Model Building Pipelines. It is added to the AmazonSageMaker-ExecutionRole that can be created when setting up SageMaker…

  • SageMakerStudioAdminProjectUserRolePolicyOperator

    This IAM policy grants an IAM role full access to AWS Glue Data Catalog (metadata) and Amazon S3 (actual data) for data lake operations, with access scoped by account, and role tags.

  • SageMakerStudioProjectUserRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions.

  • SageMakerStudioUserIAMConsolePolicyOperator

    Provides individual setup privileges for Amazon SageMaker Unified Studio via the AWS Management Console and SDK. Allows launching of SageMaker Unified Studio Portal.

Data Exchange (4)

  • AWSDataExchangeDataGrantOwnerFullAccessOperator

    Gives Data Grant owners access to AWS Data Exchange actions using the AWS Management Console and SDK.

  • AWSDataExchangeDataGrantReceiverFullAccessOperator

    Gives Data Grant receiver access to AWS Data Exchange actions using the AWS Management Console and SDK.

  • AWSDataExchangeProviderFullAccessOperator

    Grants data provider access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.

  • AWSDataExchangeSubscriberFullAccessOperator

    Grants data subscriber access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.

OpenSearch (4)

Redshift (4)

  • AmazonRedshiftAllCommandsFullAccessOperator

    This policy includes permissions to run SQL commands to copy, load, unload, query, and analyze data on Amazon Redshift. The policy also grants permissions to run select statements for related services, such as Amazon S3, Amazon CloudWatch l…

  • AmazonRedshiftDataFullAccessOperator

    This policy provides full access to Amazon Redshift Data APIs. This policy also grants scoped access to other required services.

  • AmazonRedshiftFederatedAuthorizationOperator

    This is an ease-of-use policy for running queries with Amazon Redshift Federated Authorization

  • AmazonRedshiftQueryEditorOperator

    Provides full access to the Amazon Redshift Query Editor and to saved queries via the AWS Management Console.

Glue (3)

  • AWSGlueSchemaRegistryFullAccessOperator

    Provides full access to the AWS Glue Schema Registry Service

  • AwsGlueSessionUserRestrictedNotebookPolicyOperator

    Provides permissions that allows users to create and use only the notebook sessions that are associated with the user. This policy also includes permissions to explicitly allow users to pass a restricted Glue session role.

  • AwsGlueSessionUserRestrictedPolicyOperator

    Provides permissions that allows users to create and use only the interactive sessions that are associated with the user. This policy also includes permissions to explicitly allow users to pass a restricted Glue session role.

QuickSight (2)

Other services (8)

  • AmazonDataZoneFullUserAccessOperator

    Provides full access to Amazon DataZone, but does not allow the management of domains, users, or associated accounts.

  • AmazonDataZoneRedshiftGlueProvisioningPolicyOperator

    Amazon DataZone is a data management service that enables you to catalog, discover, govern, share, and analyze your data. With Amazon DataZone, you can share and access your data across accounts and supported regions. Amazon DataZone simpli…

  • AmazonEMRFullAccessPolicy_v2Operator

    Provides full access to Amazon EMR

  • AWSCleanRoomsFullAccessNoQueryingOperator

    Allows full access to AWS Clean Rooms resources except for querying in a collaboration and access to related AWS services.

  • AWSDeepLensLambdaFunctionAccessPolicyOperator

    This policy specifies permissions required by DeepLens Administrative lambda functions that run on a DeepLens device

  • AWSMcpServiceActionsFullAccessOperator

    Provides full access to all MCP service actions. This policy does not grant access to the actions taken by the MCP, only the MCP actions themselves.

  • AWSPartnerLedSupportReadOnlyAccessOperator

    This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci…

  • CloudWatchOmniAWSIntegrationPolicyOperator

    Provides permissions required by CloudWatch Omni to discover and read AWS resource topology

Service roles (25)

Glue (4)

  • AWSGlueServiceNotebookRoleOperator

    Policy for AWS Glue service role which allows customer to manage notebook server

  • AWSGlueServiceRoleAdmin

    Policy for AWS Glue service role which allows access to related services including EC2, S3, and Cloudwatch Logs

  • AwsGlueSessionUserRestrictedNotebookServiceRoleOperator

    Provides full access to all AWS Glue resources except for sessions. Allows users to create and use only the notebook sessions that are associated with the user. This policy also includes other permissions needed by AWS Glue to manage Glue r…

  • AwsGlueSessionUserRestrictedServiceRoleOperator

    Provides full access to all AWS Glue resources except for sessions. Allows users to create and use only the interactive sessions that are associated with the user. This policy also includes other permissions needed by AWS Glue to manage Glu…

SageMaker (4)

Athena (2)

  • AmazonGrafanaAthenaAccessOperator

    This policy grants access to Amazon Athena and the dependencies needed to enable querying and writing results to s3 from the Amazon Athena plugin in Amazon Grafana.

  • AWSQuicksightAthenaAccessOperator

    Quicksight access to Athena API and S3 buckets used for Athena query results

DataZone (2)

OpenSearch (2)

QuickSight (2)

  • AmazonQuickSuiteAccessPolicyAdmin

    Provides permissions for Amazon Quick Suite to manage its IAM Identity Center application, identity store users and groups, user subscriptions, and QuickSight resources on your behalf.

  • AWSQuickSightDescribeRedshiftReader

    Allow QuickSight to describe Redshift resources

Other services (9)

Service-linked roles (12)

Also relevant to Analytics (48)
  • AdministratorAccessHigh privilegeAdmin

    Provides full access to AWS services and resources.

  • AIDevOpsAgentAccessPolicyOperator

    Provides permissions required by the AWS DevOps Agent to conduct investigations and perform analysis on customer AWS resources.

  • AIDevOpsAgentActionsPolicyHigh privilegeAdmin

    Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events.

  • AIOpsAssistantPolicyOperator

    Provides ReadOnly permissions required by the Amazon AI Operations Assistant to do analysis on customer AWS resources during investigations.

  • AmazonChimeVoiceConnectorServiceLinkedRolePolicyOperator

    Managed policy for Service Linked Role for Amazon Chime VoiceConnector

  • AmazonDataZonePreviewConsoleFullAccessOperator

    Provides full access to the Preview release of Amazon DataZone via the AWS Management Console. Also provides select access to other related services.

  • AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator

    Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneSageMakerProvisioningRolePolicyOperator

    The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.

  • AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…

  • AmazonDynamoDBReadOnlyAccessReader

    Provides read only access to Amazon DynamoDB via the AWS Management Console.

  • AmazonElasticMapReduceEditorsRoleOperator

    Default policy for the Amazon Elastic MapReduce Editors service role.

  • AmazonElasticMapReduceFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req…

  • AmazonRDSServiceRolePolicyOperator

    Allows Amazon RDS to manage AWS resources on your behalf.

  • AmazonRedshiftReadOnlyAccessReader

    Provides read only access to Amazon Redshift via the AWS Management Console.

  • AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyOperator

    Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…

  • AmazonSageMakerCanvasFullAccessOperator

    Provides full access to Amazon SageMaker Canvas resources and operations. The policy also provides select access to related services (e.g., S3, IAM, VPC, ECR, CloudWatch Logs, Redshift, Secrets Manager, and Forecast). This policy should be …

  • AmazonSageMakerFeatureStoreAccessOperator

    Provides permissions required to enable the offline store for an Amazon SageMaker FeatureStore feature group.

  • AmazonSageMakerQuickSightVPCPolicyOperator

    This policy will be used By SageMaker Unified Studios to create VPC related resources for QuickSight

  • AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator

    Service role policy used by the AWS Glue within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Glue, S3 and others.

  • AmazonSecurityLakeMetastoreManagerOperator

    Policy for Amazon SecurityLake meta store manager lambda which allows the access to cloudwatch, S3, Glue and SQS.

  • AmazonWorkSpacesWebServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by Amazon WorkSpaces Web

  • AWS_ConfigRoleOperator

    Default policy for AWS Config service role. Provides permissions required for AWS Config to track changes to your AWS resources.

  • AWSAppFabricServiceRolePolicyOperator

    Provides AppFabric access to AWS resources on your behalf

  • AWSApplicationAutoscalingEMRInstanceGroupPolicyOperator

    Policy granting permissions to Application Auto Scaling to access Elastic Map Reduce and CloudWatch.

  • AWSBackupServiceLinkedRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSCODAPermissionsBoundaryHigh privilegeAdmin

    AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.

  • AWSConfigServiceRolePolicyOperator

    Allows Config to call AWS services and collect resource configurations on your behalf.

  • AWSDiscoveryContinuousExportFirehosePolicyOperator

    Provides write access to AWS resources required for AWS Discovery Continuous Export

  • AWSGlueDataBrewServiceRoleOperator

    This policy grants permission to glue to perform action on user's glue data catalog, this policy also provides permission to ec2 actions to allow glue to create ENI to connect to resources in the VPC, also allow glue to access registered da…

  • AWSIoTRuleActionsHigh privilegeOperator

    Allows access to all AWS services supported in AWS IoT Rule Actions

  • AWSLambdaMSKExecutionRoleOperator

    Provides permissions required to access MSK Cluster within a VPC, manage ENIs (create, describe, delete) in the VPC and write permissions to CloudWatch Logs.

  • AWSLicenseManagerMasterAccountRolePolicyOperator

    AWS License Manager service master account role policy

  • AWSResourceGroupsReadOnlyAccessReader

    This is the read only policy for AWS Resource Groups

  • AWSWellArchitectedAgentResourceScanningServiceRolePolicyOperator

    Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations

  • DatabaseAdministratorHigh privilegeAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS database services.

  • DataScientistHigh privilegeAdmin

    Grants permissions to AWS data analytics services.

  • PowerUserAccessHigh privilegeAdmin

    Provides full access to AWS services and resources, but does not allow management of Users and groups.

  • SageMakerStudioAdminIAMDefaultExecutionPolicyAdmin

    Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in your account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

  • SageMakerStudioAdminIAMPermissiveExecutionPolicyHigh privilegeAdmin

    Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch L…

  • SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicyOperator

    Provides access to configure vector stores and Amazon Bedrock knowledge bases in SageMaker Studio.

  • SageMakerStudioProjectRoleMachineLearningPolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to SageMaker.

  • SageMakerStudioUserIAMDefaultExecutionPolicyAdmin

    Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in the local account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

  • SageMakerStudioUserIAMPermissiveExecutionPolicyHigh privilegeAdmin

    Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in your account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of Sag…

  • SecurityAuditOperator

    The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.

  • SecurityLakeResourceManagementServiceRolePolicyOperator

    Provides access to manage resources created by Security Lake.

  • WellArchitectedAgentResourceScanningOperator

    Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations

  • WorkLinkServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by Amazon WorkLink

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.