Application Integration: Switch between the hub and domains
Application Integration policies
Messaging, eventing, workflows and API integration between applications.
45 AWS managed policies. 6 have reviewed guidance; the rest have authoritative permission data pending editorial review. 10 are service-linked role policies, shown with permission data only.
Loading map…
Loading map
User access (27)
EventBridge (8)
- AmazonEventBridgeFullAccessAdmin
Provides full access to Amazon EventBridge.
- AmazonEventBridgePipesFullAccessAdmin
Provides full access to Amazon EventBridge Pipes.
- AmazonEventBridgePipesReadOnlyAccessReader
Provides read-only access to Amazon EventBridge Pipes.
- AmazonEventBridgeReadOnlyAccessReader
Provides read only access to Amazon EventBridge.
- AmazonEventBridgeSchedulerFullAccessAdmin
The AmazonEventBridgeSchedulerFullAccess managed policy grants permissions to use all EventBridge Scheduler actions for schedules, and schedule groups.
- AmazonEventBridgeSchedulerReadOnlyAccessReader
The AmazonEventBridgeSchedulerReadOnlyAccess managed policy grants read-only permissions to view details about your schedules and schedule groups
- AmazonEventBridgeSchemasFullAccessAdmin
Provides full access to Amazon EventBridge Schemas.
- AmazonEventBridgeSchemasReadOnlyAccessReader
Provides read only access to Amazon EventBridge Schemas.
MQ (4)
- AmazonMQApiFullAccessAdmin
Provides full access to AmazonMQ via our API/SDK.
- AmazonMQApiReadOnlyAccessReader
Provides read only access to AmazonMQ via our API/SDK.
- AmazonMQFullAccessAdmin
Provides full access to AmazonMQ via the AWS Management Console.
- AmazonMQReadOnlyAccessReader
Provides read only access to AmazonMQ via the AWS Management Console.
Step Functions (3)
- AWSStepFunctionsConsoleFullAccessAdmin
An access policy for providing a user/role/etc access to the AWS StepFunctions console. For a full console experience, in addition to this policy, a user may need iam:PassRole permission on other IAM roles that can be assumed by the service…
- AWSStepFunctionsFullAccessAdmin
An access policy for providing a user/role/etc access to the AWS StepFunctions API. For full access, in addition to this policy, a user MUST have iam:PassRole permission on at least one IAM role that can be assumed by the service.
- AWSStepFunctionsReadOnlyAccessReader
An access policy for providing a user/role/etc read only access to the AWS StepFunctions service.
AppFabric (2)
- AWSAppFabricFullAccessAdmin
Provides full access to the AWS AppFabric service and read only access to dependent services such as S3, Kinesis, KMS.
- AWSAppFabricReadOnlyAccessReader
Provides read only access to the AWS AppFabric
AppFlow (2)
- AmazonAppFlowFullAccessAdmin
Provides full access to Amazon AppFlow and access to AWS services supported as flow source or destination (S3 and Redshift). Also provides access to KMS for encryption
- AmazonAppFlowReadOnlyAccessReader
Provides read only access to Amazon Appflow flows
CloudWatch (2)
- CloudWatchEventsFullAccessAdmin
Provides full access to Amazon CloudWatch Events.
- CloudWatchEventsReadOnlyAccessReader
Provides read only access to Amazon CloudWatch Events.
SNS (2)
- AmazonSNSFullAccessAdmin
Provides full access to Amazon SNS via the AWS Management Console.
- AmazonSNSReadOnlyAccessReader
Provides read only access to Amazon SNS via the AWS Management Console.
SQS (2)
- AmazonSQSFullAccessAdmin
Provides full access to Amazon SQS via the AWS Management Console.
- AmazonSQSReadOnlyAccessReader
Provides read only access to Amazon SQS via the AWS Management Console.
Other services (2)
- AWSAppSyncAdministratorAdmin
Provides administrative access to the AppSync service, though not enough to access via the console.
- SimpleWorkflowFullAccessAdmin
Provides full access to the Simple Workflow configuration service.
Operator and limited (4)
- AmazonEventBridgePipesOperatorAccessOperator
Provides read-only and operator (ability to Stop and Start running Pipes) access to Amazon EventBridge Pipes.
- AmazonSageMakerGroundTruthExecutionOperator
Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job
- AWSAppSyncInvokeFullAccessOperator
Provides full invoking access to the AppSync service - both through the console and independently
- AWSAppSyncSchemaAuthorOperator
Provides access to create, update, and query the schema.
Service roles (4)
- AmazonTextractServiceRoleOperator
Allows Textract to call AWS services on your behalf.
- AutoScalingNotificationAccessRoleOperator
Default policy for the AutoScaling Notification Access service role.
- AWSElasticBeanstalkRoleSNSOperator
(Elastic Beanstalk operations role) Allows an environment to enable Amazon SNS topic integration.
- AWSIoTDeviceDefenderPublishFindingsToSNSMitigationActionOperator
Provides messages publish access to SNS topic for execution of PUBLISH\_FINDING\_TO\_SNS mitigation action
Service-linked roles (10)
- AmazonEventBridgeSchemasServiceRolePolicyOperator
Grants permissions to Managed Rules created by Amazon EventBridge schemas.
- AmazonODBServiceRolePolicyOperator
Allows Oracle Database@AWS to manage AWS resources on your behalf.
- AppIntegrationsServiceLinkedRolePolicyOperator
Allows AppIntegrations to manage AppFlow resources and publish CloudWatch metric data on your behalf.
- AppRunnerServiceRolePolicyOperator
Allows AWS AppRunner to manage related AWS resources on your behalf.
- AWSEC2SqlHaServiceRolePolicyOperator
EC2 SQL High Availability service permissions to detect standby/passive instances
- AWSHealth_EventProcessorServiceRolePolicyOperator
Allows AWS Health to enable the Health event processor feature.
- AWSManagedServices_EventsServiceRolePolicyOperator
AWS Managed Services policy to enable AMS event processor feature.
- AWSServiceRoleForCodeGuru-ProfilerOperator
A service-linked role required for Amazon CodeGuru Profiler to send notifications on your behalf.
- AWSVPCFlowLogsServiceRolePolicyOperator
Provides permissions to control service managed resources and call APIs necessary for log field enrichment on behalf of customers.
- CloudTrailEventContextOperator
This service linked role allows CloudTrail to get and add resource tags to the resource owner's CloudTrail events.
Also relevant to Application Integration (61)
- AmazonCloudWatchEvidentlyFullAccessOperator
Provides full only access to Amazon CloudWatch Evidently. Also provides access to related Amazon S3, Amazon SNS, Amazon CloudWatch, and other related services.
- AmazonCodeGuruReviewerFullAccessOperator
Grants full access to Amazon CodeGuru Reviewer and scoped access to required dependencies.
- AmazonCodeGuruReviewerServiceRolePolicyOperator
A service-linked role required for Amazon CodeGuru Reviewer to access resources on your behalf.
- AmazonConnectCampaignsServiceLinkedRolePolicyOperator
Policy for Amazon Connect Campaigns service linked role
- AmazonDevOpsGuruConsoleFullAccessAdmin
The policy grants full-access to the DevOps Guru console.
- AmazonDevOpsGuruFullAccessAdmin
Provides full access to Amazon DevOps Guru.
- AmazonDevOpsGuruServiceRolePolicyOperator
A service-linked role required for Amazon DevOpsGuru to access your resources.
- AmazonEKSConnectorServiceRolePolicyOperator
This policy allows Amazon EKS to manage AWS resources for EKS connector
- AmazonFISServiceRolePolicyOperator
Policy to enable AWS FIS to manage monitoring and resource selection for experiments.
- AmazonInspector2AmiScanServiceRolePolicyOperator
Grants Amazon Inspector access to AWS services needed to perform security assessments for AMI
- AmazonInspectorReadOnlyAccessReader
Provides read only access to Amazon Inspector.
- AmazonRDSCustomInstanceProfileRolePolicyOperator
Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.
- AmazonRDSCustomPreviewServiceRolePolicyOperator
Amazon RDS Custom Preview Service Role Policy
- AmazonRDSCustomServiceRolePolicyOperator
Allows Amazon RDS Custom to manage AWS resources on your behalf.
- AmazonRedshiftReadOnlyAccessReader
Provides read only access to Amazon Redshift via the AWS Management Console.
- AmazonRekognitionServiceRoleOperator
Allows Rekognition to call AWS services on your behalf.
- AmazonS3FilesFullAccessAdmin
Provides full access to all S3 Files via the AWS Management Console.
- AmazonSageMakerPipelinesIntegrationsOperator
This Amazon Managed Policy grants permissions commonly needed for use with Callback steps and Lambda steps in SageMaker Model Building Pipelines. It is added to the AmazonSageMaker-ExecutionRole that can be created when setting up SageMaker…
- AmazonSecurityLakeAdministratorAdmin
Provides full access to Amazon Security Lake and related services needed to administer Security Lake.
- AmazonSecurityLakeMetastoreManagerOperator
Policy for Amazon SecurityLake meta store manager lambda which allows the access to cloudwatch, S3, Glue and SQS.
- AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator
Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th…
- AmazonSSMMaintenanceWindowRoleOperator
Service Role to be used for EC2 Maintenance Window
- AmazonSSMServiceRolePolicyOperator
Provides access to AWS Resources managed or used by Amazon SSM
- AmplifyBackendDeployFullAccessOperator
Provides Amplify full access permissions to deploy Amplify backend resources (AWS AppSync, Amazon Cognito, Amazon S3 and other related services) via the AWS Cloud Development Kit (AWS CDK)
- AWSBackupServiceRolePolicyForS3BackupOperator
Policy containing permissions necessary for AWS Backup to backup data in any S3 bucket. This includes read access to all S3 objects and any decrypt access for all KMS keys.
- AWSBedrockAgentCoreRuntimeInstancesServiceRolePolicyOperator
Allows Bedrock AgentCore Runtime Instances to manage compute resources on your behalf.
- AWSChatbotServiceLinkedRolePolicyOperator
The Service Linked Role used by AWS Chatbot.
- AWSCodeBuildAdminAccessAdmin
Provides full access to AWS CodeBuild via the AWS Management Console. Also attach AmazonS3ReadOnlyAccess to provide access to download build artifacts, and attach IAMFullAccess to create and manage the service role for CodeBuild.
- AWSCodeCommitFullAccessAdmin
Provides full access to AWS CodeCommit via the AWS Management Console.
- AWSCodeDeployRoleForLambdaOperator
Provides CodeDeploy service access to perform a Lambda deployment on your behalf.
- AWSCodePipeline_FullAccessAdmin
Provides full access to AWS CodePipeline via the AWS Management Console.
- AWSCodeStarNotificationsServiceRolePolicyOperator
Allows AWS CodeStar Notifications to access Amazon CloudWatch Events on your behalf
- AWSControlTowerAccountServiceRolePolicyOperator
Allows AWS Control Tower to call AWS services that provide automated account configuration and centralized governance on your behalf.
- AWSDataLifecycleManagerServiceRoleOperator
Provides appropriate permissions to AWS Data Lifecycle Manager to take actions on AWS resources
- AWSDirectoryServiceReadOnlyAccessReader
Provides read only access to AWS Directory Service.
- AWSElasticBeanstalkEnhancedHealthOperator
AWS Elastic Beanstalk Service policy for Health Monitoring system
- AWSElasticBeanstalkRoleWorkerTierOperator
(Elastic Beanstalk operations role) Allows a worker environment tier to create an Amazon DynamoDB table and an Amazon SQS queue.
- AWSIoTFleetHubFederationAccessOperator
Federation access for IoT Fleet Hub applications
- AWSIoTRuleActionsHigh privilegeOperator
Allows access to all AWS services supported in AWS IoT Rule Actions
- AWSLambdaFullAccessHigh privilegeAdmin
This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.
- AWSLambdaSQSQueueExecutionRoleOperator
Provides receive message, delete message, and read attribute access to SQS queues, and write permissions to CloudWatch logs.
- AWSMigrationHubOrchestratorServiceRolePolicyOperator
Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads
- AWSQuickSetupDeploymentRolePolicyOperator
Provides permissions for AWS Systems Manager Quick Setup to deploy multiple configuration types. These configuration types create IAM roles and automations that configure frequently used Amazon Web Services services and features with recomm…
- AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
The AWSQuickSetupDevOpsGuruPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure Amazon DevOps Guru. Thi…
- AWSSecurityIncidentResponseTriageServiceRolePolicyOperator
Provides access to AWS Security Incident Response to continuously monitor your environment for security threats, tune security services to reduce alert noise, and gather information to investigate potential incidents.
- AWSSSMForSAPServiceLinkedRolePolicyOperator
Provides AWS Systems Manager for SAP with the permissions needed to manage and integrate SAP software with AWS.
- AWSSupplyChainFederationAdminAccessOperator
AWSSupplyChainFederationAdminAccess provides AWS Supply Chain federated users access to the AWS Supply Chain application, including the required permissions to perform actions within the AWS Supply Chain application. The policy provides adm…
- AWSSystemsManagerEnableConfigRecordingExecutionPolicyOperator
Provides permissions for AWS Systems Manager Quick Setup to enable and configure AWS Config configuration recording.
- AWSThinkboxAWSPortalWorkerPolicyOperator
This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.
- AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator
Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.
- AWSThinkboxDeadlineResourceTrackerAdminPolicyOperator
Grants permissions required to create, destroy, and administer AWS Thinkbox's Deadline Resource Tracker.
- AWSThinkboxDeadlineSpotEventPluginWorkerPolicyOperator
Grant permissions required for an EC2 instance running AWS Thinkbox Deadline Spot Event Plugin Worker software.
- AWSTransformInfrastructureExecutorAccessBatchOperator
Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch jo…
- AWSTransformInfrastructureExecutorAccessEC2Operator
Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, re…
- AWSUserNotificationsServiceLinkedRolePolicyOperator
Allows AWS User Notifications to call AWS services on your behalf.
- BedrockAgentCoreRuntimeInstancesOperatorRolePolicyOperator
Provides access to create and manage compute and associated resources for Bedrock AgentCore Runtime Instances
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
Cloudwatch Application Insights Service Linked Role Policy
- CloudWatchAutomaticDashboardsAccessReader
Provides access to the non-CloudWatch APIs used to display CloudWatch Automatic Dashboards, including the contents of objects such as Lambda functions
- CloudWatchFullAccessAdmin
Provides full access to CloudWatch.
- EC2FastLaunchServiceRolePolicyOperator
Policy grants ec2fastlaunch to prepare and manage preprovisioned snapshots in customer's account & publish related metrics.
- SecurityLakeResourceManagementServiceRolePolicyOperator
Provides access to manage resources created by Security Lake.