Business Applications: Switch between the hub and domains
Business Applications policies
Contact centre, customer engagement, messaging, location, marketplace and partner services.
73 AWS managed policies. 3 have reviewed guidance; the rest have authoritative permission data pending editorial review. 9 are service-linked role policies, shown with permission data only.
Loading map…
Loading map
User access (28)
Marketplace (6)
- AWSMarketplaceDiscoveryFullAccessReader
Provides full access to the AWS Marketplace Discovery API for searching and retrieving product and pricing information.
- AWSMarketplaceFullAccessAdmin
Provides the ability to subscribe and unsubscribe to AWS Marketplace software, allows users to manage Marketplace software instances from the Marketplace 'Your Software' page, and provides administrative access to EC2.
- AWSMarketplaceGetEntitlementsReader
Provides read access to AWS Marketplace Entitlements
- AWSMarketplaceRead-onlyReader
Provides the ability to review AWS Marketplace subscriptions
- AWSMarketplaceSellerFullAccessAdmin
Provides full access to all seller operations on the AWS Marketplace and other AWS services such as AMI management.
- AWSMarketplaceSellerProductsReadOnlyReader
Provide sellers read-only access to AWS Marketplace Management Products page.
Honeycode (3)
- AmazonHoneycodeFullAccessAdmin
Provides full access to Honeycode via the AWS Management Console and the SDK.
- AmazonHoneycodeTeamAssociationReadOnlyAccessReader
Provides read only access to Honeycode Team Association via the AWS Management Console and the SDK.
- AmazonHoneycodeWorkbookReadOnlyAccessReader
Provides read only access to Honeycode Workbook via the AWS Management Console and the SDK.
Alexa for Business (2)
- AlexaForBusinessFullAccessAdmin
Grants full access to AlexaForBusiness resources and access to related AWS services
- AlexaForBusinessReadOnlyAccessReader
Provide read only access to AlexaForBusiness services
Chime (2)
- AmazonChimeFullAccessAdmin
Provides full access to Amazon Chime Admin Console via the AWS Management Console.
- AmazonChimeReadOnlyReader
Provides read only access to Amazon Chime Admin Console via the AWS Management Console.
Connect (2)
- AmazonConnect_FullAccessAdmin
The purpose of this policy is to grant permissions to AWS Connect users required to use Connect resources. This policy provides full access to AWS Connect resources via the Connect Console and public APIs
- AmazonConnectReadOnlyAccessReader
Grants permission to view the Amazon Connect instances in your AWS account.
Managed Blockchain (2)
- AmazonManagedBlockchainConsoleFullAccessAdmin
Provides full access to Amazon Managed Blockchain via the AWS Management Console
- AmazonManagedBlockchainFullAccessAdmin
Provides full access to Amazon Managed Blockchain.
MechanicalTurk (2)
- AmazonMechanicalTurkFullAccessAdmin
Provides full access to all APIs in Amazon Mechanical Turk.
- AmazonMechanicalTurkReadOnlyReader
Provides access to read only APIs in Amazon Mechanical Turk.
Mobile Analytics (2)
- AmazonMobileAnalyticsFinancialReportAccessReader
Provides read only access to all reports including financial data for all application resources.
- AmazonMobileAnalyticsNon-financialReportAccessReader
Provides read only access to non financial reports for all application resources.
One (2)
- AmazonOneEnterpriseFullAccessAdmin
This policy grants administrative permissions that allow access to all Amazon One Enterprise resources and operations.
- AmazonOneEnterpriseReadOnlyAccessReader
This policy grants read only permissions to all Amazon One Enterprise resources and operations.
SES (2)
- AmazonSESFullAccessAdmin
Provides full access to Amazon SES via the AWS Management Console.
- AmazonSESReadOnlyAccessReader
Provides read only access to Amazon SES via the AWS Management Console.
WorkMail (2)
- AmazonWorkMailFullAccessAdmin
Provides full access to WorkMail, Directory Service, SES, EC2 and read access to KMS metadata.
- AmazonWorkMailReadOnlyAccessReader
Provides read only access to WorkMail and SES.
Other services (1)
- AWSIQFullAccessAdmin
Provides full access to AWS IQ
Operator and limited (36)
Partner Central (15)
- AWSPartnerCentralBusinessPlanManagementOperator
Provides access to manage business plans and their attachments in AWS Partner Central, including read access to the Partner Central and AWS Marketplace reporting data behind business plan metrics
- AWSPartnerCentralChannelHandshakeApprovalManagementOperator
Provides necessary access for channel handshake approval management activities.
- AWSPartnerCentralChannelManagementOperator
Provides necessary access for channel management activities.
- AWSPartnerCentralFullAccessOperator
Provides full access to AWS Partner Central and related AWS services.
- AWSPartnerCentralMarketingManagementOperator
Provides necessary access for marketing activities.
- AWSPartnerCentralOpportunityManagementOperator
Provides necessary access for opportunity management activities.
- AWSPartnerCentralRevenueAttributionManagementOperator
Provides necessary access for revenue attribution management activities.
- AWSPartnerCentralSandboxFullAccessOperator
Provides necessary access for developer testing in the Sandbox catalog.
- AWSPartnerCentralSellingResourceSnapshotJobExecutionRolePolicyOperator
Provides access to the ResourceSnapshotJob to read a resource and snapshot it in the target engagement.
- AWSPartnerProServeToolsFullAccessOperator
Provides full access to ProServe tools.
- AWSPartnerProServeToolsIndividualContributorOperator
Provides access to create and manage own assessments in ProServe tools.
- AWSPartnerProServeToolsOrganizationReaderIndividualContributorOperator
Provides read access to organizational assessments with ability to manage own assessments.
- AWSRevenueAttributionManagementOperator
Provides necessary access for revenue attribution management activities.
- PartnerCentralAccountManagementUserRoleAssociationOperator
Provides access to associate and dissociate partner central users with IAM roles
- PartnerCentralIncentiveBenefitManagementOperator
Policy provides access to manage all the incentive benefits in AWS Partner Central.
Marketplace (7)
- AWSMarketplaceManageSubscriptionsOperator
Provides the ability to subscribe and unsubscribe to AWS Marketplace software
- AWSMarketplaceMeteringFullAccessOperator
Provides full access to AWS Marketplace Metering.
- AWSMarketplaceMeteringRegisterUsageOperator
Provides permissions to register a resource and track usage through AWS Marketplace Metering Service.
- AWSMarketplaceSellerOfferManagementOperator
Provides sellers access to Offers and Agreements management activities.
- AWSMarketplaceSellerProductsFullAccessOperator
Provides sellers full access to AWS Marketplace Management Products page and other AWS services such as AMI management.
- AWSPrivateMarketplaceRequestsOperator
Provides access to creating requests in an AWS Private Marketplace.
- ROSAManageSubscriptionOperator
This policy provides the permissions required to manage the Red Hat OpenShift Service on AWS (ROSA) subscription.
Alexa for Business (4)
- AlexaForBusinessDeviceSetupOperator
Provide device setup access to AlexaForBusiness services
- AlexaForBusinessGatewayExecutionOperator
Provide gateway execution access to AlexaForBusiness services
- AlexaForBusinessLifesizeDelegatedAccessPolicyOperator
Provide access to Lifesize AVS devices
- AlexaForBusinessPolyDelegatedAccessPolicyOperator
Provide access to Poly AVS devices
Honeycode (3)
- AmazonHoneycodeReadOnlyAccessOperator
Provides read only access to Honeycode via the AWS Management Console and the SDK.
- AmazonHoneycodeTeamAssociationFullAccessOperator
Provides full access to Honeycode Team Association via the AWS Management Console and the SDK.
- AmazonHoneycodeWorkbookFullAccessOperator
Provides full access to Honeycode Workbook via the AWS Management Console and the SDK.
Chime (2)
- AmazonChimeSDKOperator
Provides access to Amazon Chime SDK operations
- AmazonChimeUserManagementOperator
Provides user management access to Amazon Chime Admin Console via the AWS Management Console.
Mobile Analytics (2)
- AmazonMobileAnalyticsFullAccessOperator
Provides full access to all application resources.
- AmazonMobileAnalyticsWriteOnlyAccessOperator
Provides write only access to put event data for all application resources. (Recommended for SDK integration)
Other services (3)
- AmazonManagedBlockchainReadOnlyAccessOperator
Provides read-only access to Amazon Managed Blockchain.
- AmazonOneEnterpriseInstallerAccessOperator
This policy grants limited read and write permissions that allow device installation and activation.
- AWSTransformRevenueAttributionPolicyOperator
Enables the AWS Transform service to manage customer revenue attribution for incentives.
Service-linked roles (9)
- AmazonChimeVoiceConnectorServiceLinkedRolePolicyOperator
Managed policy for Service Linked Role for Amazon Chime VoiceConnector
- AmazonCognitoIdpEmailServiceRolePolicyOperator
Allows Amazon Cognito User Pools service to use your SES identities for email sending
- AmazonConnectCampaignsServiceLinkedRolePolicyOperator
Policy for Amazon Connect Campaigns service linked role
- AmazonConnectServiceLinkedRolePolicyAdmin
Allows Amazon Connect to create and manage AWS resources on your behalf.
- AmazonConnectSynchronizationServiceRolePolicyOperator
Allows Amazon Connect to synchronize AWS resources across regions on your behalf.
- AWSIQContractServiceRolePolicyOperator
Used by AWS IQ to execute payment requests on behalf of a customer
- AWSPartnerCentralAccountManagementServiceRolePolicyOperator
Allows AWS Partner Central to access and manage your partner account resources, including partner account details and business plans, on your behalf.
- AWSServiceRoleForPrivateMarketplaceAdminPolicyOperator
Provides permissions to describe and update Private Marketplace resources and describe AWS Organizations
- CustomerProfilesServiceLinkedRolePolicyOperator
Allows Amazon Connect Customer Profiles to access AWS services and resources on your behalf.
Also relevant to Business Applications (25)
- AdministratorAccessHigh privilegeAdmin
Provides full access to AWS services and resources.
- AdministratorAccess-AmplifyHigh privilegeAdmin
Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications.
- AIDevOpsAgentActionsPolicyHigh privilegeAdmin
Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events.
- AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicyOperator
Managed Policy For Amazon Chime SDK MediaPipelines Service Linked Role
- AmazonCognitoUnAuthedIdentitiesSessionPolicyAdmin
This policy defines the set of permissions allowed for unauthenticated identities for Cognito Identity Pools. This policy is not intended to be used as a stand alone permission policy. It is used as a guardrail against overly permissive pol…
- AmazonSNSFullAccessAdmin
Provides full access to Amazon SNS via the AWS Management Console.
- AmazonSNSReadOnlyAccessReader
Provides read only access to Amazon SNS via the AWS Management Console.
- AmazonTimestreamConsoleFullAccessHigh privilegeAdmin
Provides full access to manage Amazon Timestream using the AWS Management Console. Note that this policy also grants permissions for certain KMS operations, and operations to manage your saved queries. If using Customer managed CMK, please …
- AWSCODAPermissionsBoundaryHigh privilegeAdmin
AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.
- AWSDataExchangeFullAccessAdmin
Grants full access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.
- AWSDataExchangeProviderFullAccessOperator
Grants data provider access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.
- AWSDataExchangeReadOnlyReader
Grants read-only access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK.
- AWSDataExchangeSubscriberFullAccessOperator
Grants data subscriber access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.
- AWSElasticBeanstalkMulticontainerDockerOperator
Provide the instances in your multicontainer Docker environment access to use the Amazon EC2 Container Service to manage container deployment tasks.
- AWSMarketplaceImageBuildFullAccessOperator
Provides full access to AWS Marketplace Private Image Build Feature. In addition to create private images, it also provides permissions to add tags to images, launch and terminate ec2 instances.
- AWSMarketplaceResaleAuthorizationServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by AWS Marketplace for Resale Authorization.
- AWSMarketplaceSubsidiaryAuthorizationServiceRolePolicyOperator
Enables AWS Marketplace to share Subsidiary Authorization entities across AWS accounts on the customer's behalf using AWS Resource Access Manager.
- AWSMcpServiceActionsFullAccessOperator
Provides full access to all MCP service actions. This policy does not grant access to the actions taken by the MCP, only the MCP actions themselves.
- AWSPrivateMarketplaceAdminFullAccessOperator
Provides full access to all administrative actions for an AWS Private Marketplace.
- AWSSupplyChainFederationAdminAccessOperator
AWSSupplyChainFederationAdminAccess provides AWS Supply Chain federated users access to the AWS Supply Chain application, including the required permissions to perform actions within the AWS Supply Chain application. The policy provides adm…
- AWSVendorInsightsAssessorFullAccessOperator
Provides full access for viewing entitled Vendor Insights resources and managing Vendor Insights subscriptions
- AWSVendorInsightsVendorFullAccessAdmin
Provides full access for creating and managing the Vendor Insights resources
- AWSVendorInsightsVendorReadOnlyReader
Provides read-only access for viewing the Vendor Insights resources
- PowerUserAccessHigh privilegeAdmin
Provides full access to AWS services and resources, but does not allow management of Users and groups.
- SystemAdministratorHigh privilegeAdmin
Grants full access permissions necessary for resources required for application and development operations.