Analytics: Operator policies
Data lakes, warehouses, streaming, search and business intelligence.
63 AWS managed policies. 4 have reviewed guidance; the rest have authoritative permission data pending editorial review. 11 are service-linked role policies, shown with permission data only.
Operator and limited (30)
SageMaker (5)
- AmazonSageMakerCanvasDataPrepFullAccessOperator
Provides full access to Amazon SageMaker resources and operations for data preparation in Canvas. The policy also provides select access to related services (e.g., S3, IAM, KMS, RDS, CloudWatch Logs, Redshift, Athena, Glue, EventBridge, Sec…
- AmazonSageMakerPipelinesIntegrationsOperator
This Amazon Managed Policy grants permissions commonly needed for use with Callback steps and Lambda steps in SageMaker Model Building Pipelines. It is added to the AmazonSageMaker-ExecutionRole that can be created when setting up SageMaker…
- SageMakerStudioAdminProjectUserRolePolicyOperator
This IAM policy grants an IAM role full access to AWS Glue Data Catalog (metadata) and Amazon S3 (actual data) for data lake operations, with access scoped by account, and role tags.
- SageMakerStudioProjectUserRolePolicyOperator
Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions.
- SageMakerStudioUserIAMConsolePolicyOperator
Provides individual setup privileges for Amazon SageMaker Unified Studio via the AWS Management Console and SDK. Allows launching of SageMaker Unified Studio Portal.
Data Exchange (4)
- AWSDataExchangeDataGrantOwnerFullAccessOperator
Gives Data Grant owners access to AWS Data Exchange actions using the AWS Management Console and SDK.
- AWSDataExchangeDataGrantReceiverFullAccessOperator
Gives Data Grant receiver access to AWS Data Exchange actions using the AWS Management Console and SDK.
- AWSDataExchangeProviderFullAccessOperator
Grants data provider access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.
- AWSDataExchangeSubscriberFullAccessOperator
Grants data subscriber access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.
OpenSearch (4)
- AmazonOpenSearchDirectQueryGlueCreateAccessOperator
Allows OpenSearch DirectQuery Service to access AWS Glue APIs for creating resources on your behalf.
- AmazonOpenSearchIngestionFullAccessOperator
Allows Amazon OpenSearch Ingestion to access other AWS services on your behalf.
- CloudWatchOpenSearchDashboardAccessOperator
This policy provides user access to view OpenSearch dashboards on the CloudWatch Logs console.
- CloudWatchOpenSearchDashboardsFullAccessOperator
This policy provides user access to create integration with OpenSearch to create, update, delete or view dashboards on the CloudWatch Logs console.
Redshift (4)
- AmazonRedshiftAllCommandsFullAccessOperator
This policy includes permissions to run SQL commands to copy, load, unload, query, and analyze data on Amazon Redshift. The policy also grants permissions to run select statements for related services, such as Amazon S3, Amazon CloudWatch l…
- AmazonRedshiftDataFullAccessOperator
This policy provides full access to Amazon Redshift Data APIs. This policy also grants scoped access to other required services.
- AmazonRedshiftFederatedAuthorizationOperator
This is an ease-of-use policy for running queries with Amazon Redshift Federated Authorization
- AmazonRedshiftQueryEditorOperator
Provides full access to the Amazon Redshift Query Editor and to saved queries via the AWS Management Console.
Glue (3)
- AWSGlueSchemaRegistryFullAccessOperator
Provides full access to the AWS Glue Schema Registry Service
- AwsGlueSessionUserRestrictedNotebookPolicyOperator
Provides permissions that allows users to create and use only the notebook sessions that are associated with the user. This policy also includes permissions to explicitly allow users to pass a restricted Glue session role.
- AwsGlueSessionUserRestrictedPolicyOperator
Provides permissions that allows users to create and use only the interactive sessions that are associated with the user. This policy also includes permissions to explicitly allow users to pass a restricted Glue session role.
QuickSight (2)
- AWSQuickSightAssetBundleExportPolicyOperator
Provides the set of permissions required to perform QuickSight Asset Bundle Export Operations
- AWSQuickSightAssetBundleImportPolicyOperator
Provides the set of permissions required to perform QuickSight Asset Bundle Import Operations
Other services (8)
- AmazonDataZoneFullUserAccessOperator
Provides full access to Amazon DataZone, but does not allow the management of domains, users, or associated accounts.
- AmazonDataZoneRedshiftGlueProvisioningPolicyOperator
Amazon DataZone is a data management service that enables you to catalog, discover, govern, share, and analyze your data. With Amazon DataZone, you can share and access your data across accounts and supported regions. Amazon DataZone simpli…
- AmazonEMRFullAccessPolicy_v2Operator
Provides full access to Amazon EMR
- AWSCleanRoomsFullAccessNoQueryingOperator
Allows full access to AWS Clean Rooms resources except for querying in a collaboration and access to related AWS services.
- AWSDeepLensLambdaFunctionAccessPolicyOperator
This policy specifies permissions required by DeepLens Administrative lambda functions that run on a DeepLens device
- AWSMcpServiceActionsFullAccessOperator
Provides full access to all MCP service actions. This policy does not grant access to the actions taken by the MCP, only the MCP actions themselves.
- AWSPartnerLedSupportReadOnlyAccessOperator
This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci…
- CloudWatchOmniAWSIntegrationPolicyOperator
Provides permissions required by CloudWatch Omni to discover and read AWS resource topology
Service roles (22)
Glue (3)
- AWSGlueServiceNotebookRoleOperator
Policy for AWS Glue service role which allows customer to manage notebook server
- AwsGlueSessionUserRestrictedNotebookServiceRoleOperator
Provides full access to all AWS Glue resources except for sessions. Allows users to create and use only the notebook sessions that are associated with the user. This policy also includes other permissions needed by AWS Glue to manage Glue r…
- AwsGlueSessionUserRestrictedServiceRoleOperator
Provides full access to all AWS Glue resources except for sessions. Allows users to create and use only the interactive sessions that are associated with the user. This policy also includes other permissions needed by AWS Glue to manage Glu…
SageMaker (4)
- SageMakerStudioDataAppsAccessRolePolicyOperator
Amazon SageMaker Studio uses this policy to access data apps shared with a user in the Amazon SageMaker Studio domain.
- SageMakerStudioDomainExecutionRolePolicyOperator
This policy is used by Amazon SageMaker Studio to catalog, discover, govern, share, and analyze data in the Amazon SageMaker Studio domain.
- SageMakerStudioProjectProvisioningRolePolicyOperator
Amazon SageMaker Studio uses this policy to provision and manage resources in your account.
- SageMakerStudioQueryExecutionRolePolicyOperator
Amazon SageMaker Studio uses this policy when running query executions on federated connections.
Athena (2)
- AmazonGrafanaAthenaAccessOperator
This policy grants access to Amazon Athena and the dependencies needed to enable querying and writing results to s3 from the Amazon Athena plugin in Amazon Grafana.
- AWSQuicksightAthenaAccessOperator
Quicksight access to Athena API and S3 buckets used for Athena query results
DataZone (2)
- AmazonDataZoneDomainExecutionRolePolicyOperator
Default policy for the Amazon DataZone's DomainExecutionRole service role. This role is used by Amazon DataZone to catalog, discover, govern, share, and analyze data in the Amazon DataZone domain.
- AmazonDataZoneGlueManageAccessRolePolicyOperator
The policy grants permissions to allow Amazon DataZone to enable publishing and access grants to data.
OpenSearch (2)
- AWSQuickSightElasticsearchPolicyOperator
Provides access to Amazon Elasticsearch resources from Amazon QuickSight
- AWSQuicksightOpenSearchPolicyOperator
Provides access to Amazon OpenSearch resources from Amazon QuickSight
Other services (9)
- AmazonDataZoneRedshiftManageAccessRolePolicyOperator
This policy gives Amazon DataZone permissions to publish Amazon Redshift data to the catalog. It also gives Amazon DataZone permissions to grant access or revoke access to Amazon Redshift or Amazon Redshift Serverless published assets in th…
- AmazonElasticMapReduceforAutoScalingRoleOperator
Amazon Elastic MapReduce for Auto Scaling. Role to allow Auto Scaling to add and remove instances from your EMR cluster.
- AmazonGrafanaRedshiftAccessOperator
This policy grants scoped access to Amazon Redshift and the dependencies needed to use the Amazon Redshift plugin in Amazon Grafana.
- AmazonMachineLearningRoleforRedshiftDataSourceV3Operator
Allows Machine Learning to configure and use your Redshift Clusters and S3 Staging Locations for Redshift Data Source.
- AmazonRekognitionServiceRoleOperator
Allows Rekognition to call AWS services on your behalf.
- AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicyOperator
Service role policy used by the AWS Firehose within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Firehose and others.
- AWSLambdaKinesisExecutionRoleOperator
Provides list and read access to Kinesis streams and write permissions to CloudWatch logs.
- AWSMSKReplicatorExecutionRoleOperator
Grants permissions to Amazon MSK Replicator to replicate data between MSK Clusters.
- CloudWatchEventsInvocationAccessOperator
Allows Amazon CloudWatch Events to relay events to the streams in AWS Kinesis Streams in your account.
Service-linked roles (11)
- AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicyOperator
Managed Policy For Amazon Chime SDK MediaPipelines Service Linked Role
- AmazonChimeSDKMessagingServiceRolePolicyOperator
Allows Amazon Chime SDK Messaging to access AWS resources and enable messaging functionality
- ApplicationDiscoveryServiceContinuousExportServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Application Discovery Service Continuous Export feature
- AWSApplicationAutoscalingKafkaClusterPolicyOperator
Policy granting permissions to Application Auto Scaling to access Managed Streaming for Apache Kafka and CloudWatch.
- AWSResourceExplorerServiceRolePolicyOperator
Allows Resource Explorer to view resources and CloudTrail events on your behalf to index your resources for search.
- AWSServiceRoleForLogDeliveryPolicyOperator
Allows Log Delivery service to deliver logs by calling log destination on your behalf.
- AWSSupportServiceRolePolicyOperator
Allows AWS Support to access AWS resources to provide billing, administrative, and support services.
- DynamoDBKinesisReplicationServiceRolePolicyOperator
Provide AWS DynamoDB access to KinesisDataStreams
- WAFLoggingServiceRolePolicyOperator
Creating SLR to write customer's logs to a firehose stream
- WAFRegionalLoggingServiceRolePolicyOperator
Creating SLR to write customer's logs to a firehose stream
- WAFV2LoggingServiceRolePolicyOperator
This policy creates a service-linked role that allows AWS WAF to write logs to Amazon Kinesis Data Firehose.
Also relevant to Analytics (33)
- AIDevOpsAgentAccessPolicyOperator
Provides permissions required by the AWS DevOps Agent to conduct investigations and perform analysis on customer AWS resources.
- AIOpsAssistantPolicyOperator
Provides ReadOnly permissions required by the Amazon AI Operations Assistant to do analysis on customer AWS resources during investigations.
- AmazonChimeVoiceConnectorServiceLinkedRolePolicyOperator
Managed policy for Service Linked Role for Amazon Chime VoiceConnector
- AmazonDataZonePreviewConsoleFullAccessOperator
Provides full access to the Preview release of Amazon DataZone via the AWS Management Console. Also provides select access to other related services.
- AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator
Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.
- AmazonDataZoneSageMakerProvisioningRolePolicyOperator
The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.
- AmazonElasticMapReduceEditorsRoleOperator
Default policy for the Amazon Elastic MapReduce Editors service role.
- AmazonRDSServiceRolePolicyOperator
Allows Amazon RDS to manage AWS resources on your behalf.
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyOperator
Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…
- AmazonSageMakerCanvasFullAccessOperator
Provides full access to Amazon SageMaker Canvas resources and operations. The policy also provides select access to related services (e.g., S3, IAM, VPC, ECR, CloudWatch Logs, Redshift, Secrets Manager, and Forecast). This policy should be …
- AmazonSageMakerFeatureStoreAccessOperator
Provides permissions required to enable the offline store for an Amazon SageMaker FeatureStore feature group.
- AmazonSageMakerQuickSightVPCPolicyOperator
This policy will be used By SageMaker Unified Studios to create VPC related resources for QuickSight
- AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator
Service role policy used by the AWS Glue within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Glue, S3 and others.
- AmazonSecurityLakeMetastoreManagerOperator
Policy for Amazon SecurityLake meta store manager lambda which allows the access to cloudwatch, S3, Glue and SQS.
- AmazonWorkSpacesWebServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Amazon WorkSpaces Web
- AWS_ConfigRoleOperator
Default policy for AWS Config service role. Provides permissions required for AWS Config to track changes to your AWS resources.
- AWSAppFabricServiceRolePolicyOperator
Provides AppFabric access to AWS resources on your behalf
- AWSApplicationAutoscalingEMRInstanceGroupPolicyOperator
Policy granting permissions to Application Auto Scaling to access Elastic Map Reduce and CloudWatch.
- AWSBackupServiceLinkedRolePolicyForBackupOperator
Provides AWS Backup permission to create backups on your behalf across AWS services
- AWSBackupServiceRolePolicyForBackupOperator
Provides AWS Backup permission to create backups on your behalf across AWS services
- AWSConfigServiceRolePolicyOperator
Allows Config to call AWS services and collect resource configurations on your behalf.
- AWSDiscoveryContinuousExportFirehosePolicyOperator
Provides write access to AWS resources required for AWS Discovery Continuous Export
- AWSGlueDataBrewServiceRoleOperator
This policy grants permission to glue to perform action on user's glue data catalog, this policy also provides permission to ec2 actions to allow glue to create ENI to connect to resources in the VPC, also allow glue to access registered da…
- AWSIoTRuleActionsHigh privilegeOperator
Allows access to all AWS services supported in AWS IoT Rule Actions
- AWSLambdaMSKExecutionRoleOperator
Provides permissions required to access MSK Cluster within a VPC, manage ENIs (create, describe, delete) in the VPC and write permissions to CloudWatch Logs.
- AWSLicenseManagerMasterAccountRolePolicyOperator
AWS License Manager service master account role policy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicyOperator
Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations
- SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicyOperator
Provides access to configure vector stores and Amazon Bedrock knowledge bases in SageMaker Studio.
- SageMakerStudioProjectRoleMachineLearningPolicyOperator
Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to SageMaker.
- SecurityAuditOperator
The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.
- SecurityLakeResourceManagementServiceRolePolicyOperator
Provides access to manage resources created by Security Lake.
- WellArchitectedAgentResourceScanningOperator
Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations
- WorkLinkServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Amazon WorkLink