Application Integration: Operator policies
Messaging, eventing, workflows and API integration between applications.
18 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review. 10 are service-linked role policies, shown with permission data only.
Operator and limited (4)
- AmazonEventBridgePipesOperatorAccessOperator
Provides read-only and operator (ability to Stop and Start running Pipes) access to Amazon EventBridge Pipes.
- AmazonSageMakerGroundTruthExecutionOperator
Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job
- AWSAppSyncInvokeFullAccessOperator
Provides full invoking access to the AppSync service - both through the console and independently
- AWSAppSyncSchemaAuthorOperator
Provides access to create, update, and query the schema.
Service roles (4)
- AmazonTextractServiceRoleOperator
Allows Textract to call AWS services on your behalf.
- AutoScalingNotificationAccessRoleOperator
Default policy for the AutoScaling Notification Access service role.
- AWSElasticBeanstalkRoleSNSOperator
(Elastic Beanstalk operations role) Allows an environment to enable Amazon SNS topic integration.
- AWSIoTDeviceDefenderPublishFindingsToSNSMitigationActionOperator
Provides messages publish access to SNS topic for execution of PUBLISH\_FINDING\_TO\_SNS mitigation action
Service-linked roles (10)
- AmazonEventBridgeSchemasServiceRolePolicyOperator
Grants permissions to Managed Rules created by Amazon EventBridge schemas.
- AmazonODBServiceRolePolicyOperator
Allows Oracle Database@AWS to manage AWS resources on your behalf.
- AppIntegrationsServiceLinkedRolePolicyOperator
Allows AppIntegrations to manage AppFlow resources and publish CloudWatch metric data on your behalf.
- AppRunnerServiceRolePolicyOperator
Allows AWS AppRunner to manage related AWS resources on your behalf.
- AWSEC2SqlHaServiceRolePolicyOperator
EC2 SQL High Availability service permissions to detect standby/passive instances
- AWSHealth_EventProcessorServiceRolePolicyOperator
Allows AWS Health to enable the Health event processor feature.
- AWSManagedServices_EventsServiceRolePolicyOperator
AWS Managed Services policy to enable AMS event processor feature.
- AWSServiceRoleForCodeGuru-ProfilerOperator
A service-linked role required for Amazon CodeGuru Profiler to send notifications on your behalf.
- AWSVPCFlowLogsServiceRolePolicyOperator
Provides permissions to control service managed resources and call APIs necessary for log field enrichment on behalf of customers.
- CloudTrailEventContextOperator
This service linked role allows CloudTrail to get and add resource tags to the resource owner's CloudTrail events.
Also relevant to Application Integration (48)
- AmazonCloudWatchEvidentlyFullAccessOperator
Provides full only access to Amazon CloudWatch Evidently. Also provides access to related Amazon S3, Amazon SNS, Amazon CloudWatch, and other related services.
- AmazonCodeGuruReviewerFullAccessOperator
Grants full access to Amazon CodeGuru Reviewer and scoped access to required dependencies.
- AmazonCodeGuruReviewerServiceRolePolicyOperator
A service-linked role required for Amazon CodeGuru Reviewer to access resources on your behalf.
- AmazonConnectCampaignsServiceLinkedRolePolicyOperator
Policy for Amazon Connect Campaigns service linked role
- AmazonDevOpsGuruServiceRolePolicyOperator
A service-linked role required for Amazon DevOpsGuru to access your resources.
- AmazonEKSConnectorServiceRolePolicyOperator
This policy allows Amazon EKS to manage AWS resources for EKS connector
- AmazonFISServiceRolePolicyOperator
Policy to enable AWS FIS to manage monitoring and resource selection for experiments.
- AmazonInspector2AmiScanServiceRolePolicyOperator
Grants Amazon Inspector access to AWS services needed to perform security assessments for AMI
- AmazonRDSCustomInstanceProfileRolePolicyOperator
Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.
- AmazonRDSCustomPreviewServiceRolePolicyOperator
Amazon RDS Custom Preview Service Role Policy
- AmazonRDSCustomServiceRolePolicyOperator
Allows Amazon RDS Custom to manage AWS resources on your behalf.
- AmazonRekognitionServiceRoleOperator
Allows Rekognition to call AWS services on your behalf.
- AmazonSageMakerPipelinesIntegrationsOperator
This Amazon Managed Policy grants permissions commonly needed for use with Callback steps and Lambda steps in SageMaker Model Building Pipelines. It is added to the AmazonSageMaker-ExecutionRole that can be created when setting up SageMaker…
- AmazonSecurityLakeMetastoreManagerOperator
Policy for Amazon SecurityLake meta store manager lambda which allows the access to cloudwatch, S3, Glue and SQS.
- AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator
Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th…
- AmazonSSMMaintenanceWindowRoleOperator
Service Role to be used for EC2 Maintenance Window
- AmazonSSMServiceRolePolicyOperator
Provides access to AWS Resources managed or used by Amazon SSM
- AmplifyBackendDeployFullAccessOperator
Provides Amplify full access permissions to deploy Amplify backend resources (AWS AppSync, Amazon Cognito, Amazon S3 and other related services) via the AWS Cloud Development Kit (AWS CDK)
- AWSBackupServiceRolePolicyForS3BackupOperator
Policy containing permissions necessary for AWS Backup to backup data in any S3 bucket. This includes read access to all S3 objects and any decrypt access for all KMS keys.
- AWSBedrockAgentCoreRuntimeInstancesServiceRolePolicyOperator
Allows Bedrock AgentCore Runtime Instances to manage compute resources on your behalf.
- AWSChatbotServiceLinkedRolePolicyOperator
The Service Linked Role used by AWS Chatbot.
- AWSCodeDeployRoleForLambdaOperator
Provides CodeDeploy service access to perform a Lambda deployment on your behalf.
- AWSCodeStarNotificationsServiceRolePolicyOperator
Allows AWS CodeStar Notifications to access Amazon CloudWatch Events on your behalf
- AWSControlTowerAccountServiceRolePolicyOperator
Allows AWS Control Tower to call AWS services that provide automated account configuration and centralized governance on your behalf.
- AWSDataLifecycleManagerServiceRoleOperator
Provides appropriate permissions to AWS Data Lifecycle Manager to take actions on AWS resources
- AWSElasticBeanstalkEnhancedHealthOperator
AWS Elastic Beanstalk Service policy for Health Monitoring system
- AWSElasticBeanstalkRoleWorkerTierOperator
(Elastic Beanstalk operations role) Allows a worker environment tier to create an Amazon DynamoDB table and an Amazon SQS queue.
- AWSIoTFleetHubFederationAccessOperator
Federation access for IoT Fleet Hub applications
- AWSIoTRuleActionsHigh privilegeOperator
Allows access to all AWS services supported in AWS IoT Rule Actions
- AWSLambdaSQSQueueExecutionRoleOperator
Provides receive message, delete message, and read attribute access to SQS queues, and write permissions to CloudWatch logs.
- AWSMigrationHubOrchestratorServiceRolePolicyOperator
Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads
- AWSQuickSetupDeploymentRolePolicyOperator
Provides permissions for AWS Systems Manager Quick Setup to deploy multiple configuration types. These configuration types create IAM roles and automations that configure frequently used Amazon Web Services services and features with recomm…
- AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
The AWSQuickSetupDevOpsGuruPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure Amazon DevOps Guru. Thi…
- AWSSecurityIncidentResponseTriageServiceRolePolicyOperator
Provides access to AWS Security Incident Response to continuously monitor your environment for security threats, tune security services to reduce alert noise, and gather information to investigate potential incidents.
- AWSSSMForSAPServiceLinkedRolePolicyOperator
Provides AWS Systems Manager for SAP with the permissions needed to manage and integrate SAP software with AWS.
- AWSSupplyChainFederationAdminAccessOperator
AWSSupplyChainFederationAdminAccess provides AWS Supply Chain federated users access to the AWS Supply Chain application, including the required permissions to perform actions within the AWS Supply Chain application. The policy provides adm…
- AWSSystemsManagerEnableConfigRecordingExecutionPolicyOperator
Provides permissions for AWS Systems Manager Quick Setup to enable and configure AWS Config configuration recording.
- AWSThinkboxAWSPortalWorkerPolicyOperator
This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.
- AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator
Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.
- AWSThinkboxDeadlineResourceTrackerAdminPolicyOperator
Grants permissions required to create, destroy, and administer AWS Thinkbox's Deadline Resource Tracker.
- AWSThinkboxDeadlineSpotEventPluginWorkerPolicyOperator
Grant permissions required for an EC2 instance running AWS Thinkbox Deadline Spot Event Plugin Worker software.
- AWSTransformInfrastructureExecutorAccessBatchOperator
Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch jo…
- AWSTransformInfrastructureExecutorAccessEC2Operator
Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, re…
- AWSUserNotificationsServiceLinkedRolePolicyOperator
Allows AWS User Notifications to call AWS services on your behalf.
- BedrockAgentCoreRuntimeInstancesOperatorRolePolicyOperator
Provides access to create and manage compute and associated resources for Bedrock AgentCore Runtime Instances
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
Cloudwatch Application Insights Service Linked Role Policy
- EC2FastLaunchServiceRolePolicyOperator
Policy grants ec2fastlaunch to prepare and manage preprovisioned snapshots in customer's account & publish related metrics.
- SecurityLakeResourceManagementServiceRolePolicyOperator
Provides access to manage resources created by Security Lake.