Skip to main content
IAM Policy Map
IAM Policy Map
Compute: Switch between the hub and domains
MapList

Can change permissions or pass roles: 50 of 226 policies: 0 unrestricted, 50 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 84 of 226 policies: 60 write, 23 read only, 1 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Compute policies

Virtual servers, scaling, batch and high-performance computing.

226 AWS managed policies. 7 have reviewed guidance; the rest have authoritative permission data pending editorial review. 105 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (20)

EC2 (6)

Auto Scaling (4)

EC2 Image Builder (2)

Elastic Beanstalk (2)

  • AWSElasticBeanstalkManagedUpdatesCustomerRolePolicyAdmin

    This policy is for the AWS Elastic Beanstalk service role used to perform managed updates of Elastic Beanstalk environments. This policy should not be attached to other users or roles. The policy grants broad permissions to create and manag…

  • AWSElasticBeanstalkReadOnlyReader

    Grants read-only permissions. Explicitly allows operators to gain direct access to retrieve information about resources related to AWS Elastic Beanstalk applications.

Other services (6)

  • AmazonECS_FullAccessAdmin

    Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups, and CloudFormation stacks.

  • AmazonEKSWorkerNodePolicyReader

    This policy allows Amazon EKS worker nodes to connect to Amazon EKS Clusters.

  • AmazonLaunchWizard_FullaccessAdmin

    Full access to AWS Launch wizard and other required services.

  • AmazonNimbleStudio-LaunchProfileWorkerReader

    This policy grants access to resources needed by Nimble Studio Launch Profile workers. Attach this policy to EC2 instances created by Nimble Studio Builder.

  • AWSBatchFullAccessAdmin

    Provides full access for AWS Batch resources.

  • AWSMigrationHubRefactorSpacesFullAccessAdmin

    Grants full access to AWS MigrationHub Refactor Spaces, AWS MigrationHub Refactor Spaces console features and other related AWS services except permissions required for AWS Lambda and AWS Resource Access Manager as they can be scoped down b…

Operator and limited (59)

EC2 (14)

  • AIDevOpsReleaseManagementVPCPolicyOperator

    Provides permissions for AWS DevOps Agent to create and manage network interfaces in your VPC so that release management agents can access private resources

  • AmazonDRSVPCManagementOperator

    Provides access to manage VPC settings for Amazon managed customer configurations

  • AmazonEBSCSIDriverEKSClusterScopedPolicyOperator

    IAM Policy that allows the CSI driver service account to make calls to related services such as EC2 on your behalf. This policy restricts the Amazon EBS CSI driver to only managing EBS volumes and snapshots that belong to a specific EKS clu…

  • AmazonElasticMapReducePlacementGroupPolicyOperator

    Policy to allow EMR to create, describe and delete EC2 placement groups.

  • AmazonVPCFullAccessOperator

    Provides full access to Amazon VPC via the AWS Management Console.

  • AmazonVPCReachabilityAnalyzerFullAccessPolicyOperator

    Provides permissions to describe AWS resources, run Reachability Analyzer, and create or delete tags on Network Insights Path and Network Insights Analysis.

  • AWSConnectorOperator

    Enables broad read/write access to ALL EC2 objects, read/write access to S3 buckets starting with 'import-to-ec2-', and the ability to list all S3 buckets, for the AWS Connector to import VMs on your behalf.

  • AWSEC2VssRestorePolicyOperator

    Grants Amazon EC2 and AWS SSM permissions to restore SQL Server database from application consistent snapshots created by AWS VSS.

  • AWSEC2VssSnapshotPolicyOperator

    This policy is attached to the IAM role that's attached to your Amazon EC2 Windows Instances to enable the Amazon EC2 VSS solution to create and add tags to Amazon Machine Images (AMI) and EBS Snapshots.

  • AWSQuickSetupStartStopInstancesExecutionPolicyOperator

    The managed policy AWSQuickSetupStartStopInstancesExecutionPolicy provides permissions for Quick Setup to start and stop Amazon EC2 instances on a schedule. This policy is used with the Quick Setup scheduler configuration type.

  • AWSThinkboxAWSPortalAdminPolicyOperator

    This policy grants AWS Thinkbox's Deadline software full access to multiple AWS services as required for AWS Portal administration. This includes access to create arbitrary tags on several EC2 resource types.

  • EC2FastLaunchFullAccessOperator

    This policy grants full access to EC2 Fast Launch actions

  • EC2InstanceConnectOperator

    Allows customers to call EC2 Instance Connect to publish ephemeral keys to their EC2 instances and connect via ssh or the EC2 Instance Connect CLI.

  • EC2InstanceProfileForImageBuilderOperator

    EC2 Instance profile for Image Builder service.

Deadline Cloud (8)

  • AWSDeadlineCloud-FleetWorkerOperator

    Provides AWS Deadline Cloud workers with access to run tasks on a farm.

  • AWSDeadlineCloud-UserAccessFarmsOperator

    Provides user workstation access to AWS Deadline Cloud farms with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessFleetsOperator

    Provides user workstation access to AWS Deadline Cloud fleets with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessJobsOperator

    Provides user workstation access to AWS Deadline Cloud jobs with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessQueuesOperator

    Provides user workstation access to AWS Deadline Cloud queues with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-WorkerHostOperator

    Provides access for AWS Deadline Cloud worker hosts to join a fleet in a farm.

  • AWSThinkboxDeadlineSpotEventPluginAdminPolicyOperator

    Grants permissions required for AWS Thinkbox's Deadline Spot Event Plugin. This includes permission to request, modify, and cancel a spot fleet, as well as limited PassRole permission.

  • AWSThinkboxDeadlineSpotEventPluginWorkerPolicyOperator

    Grant permissions required for an EC2 instance running AWS Thinkbox Deadline Spot Event Plugin Worker software.

EKS (7)

  • AmazonEKS_CNI_PolicyOperator

    This policy provides the Amazon VPC CNI Plugin (amazon-vpc-cni-k8s) the permissions it requires to modify the IP address configuration on your EKS worker nodes. This permission set allows the CNI to list, describe, and modify Elastic Networ…

  • AmazonEKSBlockStoragePolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's block storage resources.

  • AmazonEKSBlockStoragePolicyV2Operator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's block storage resources.

  • AmazonEKSComputePolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's compute resources.

  • AmazonEKSNetworkingPolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's networking resources.

  • AmazonEKSServicePolicyOperator

    This policy allows Amazon Elastic Container Service for Kubernetes to create and manage the necessary resources to operate EKS Clusters.

  • AmazonEKSVPCResourceControllerOperator

    Policy used by VPC Resource Controller to manage ENI and IPs for worker nodes.

Application Migration Service (3)

Account (2)

Lambda (2)

Marketplace (2)

  • AWSMarketplaceAmiIngestionOperator

    Allows AWS Marketplace to copy your Amazon Machine Images (AMIs) in order to list them on AWS Marketplace

  • AWSMarketplaceImageBuildFullAccessOperator

    Provides full access to AWS Marketplace Private Image Build Feature. In addition to create private images, it also provides permissions to add tags to images, launch and terminate ec2 instances.

Systems Manager (2)

  • AWS-SSM-DiagnosisAutomation-ExecutionRolePolicyOperator

    Provide permission for Diagnosing issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by diagnosing SSM service health ac…

  • AWS-SSM-RemediationAutomation-ExecutionRolePolicyOperator

    Provides permissions for Remediating issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by remediating SSM services heal…

Transform (2)

  • AWSTransformInfrastructureExecutorAccessBatchOperator

    Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch jo…

  • AWSTransformNetworkMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration

Other services (17)

Service roles (42)

EC2 (14)

  • AmazonAppStreamServiceAccessOperator

    Default policy for Amazon AppStream service role.

  • AmazonEC2ContainerServiceRoleOperator

    Default policy for Amazon ECS service role.

  • AmazonEC2SpotFleetTaggingRoleOperator

    Allows EC2 Spot Fleet to request, terminate and tag Spot Instances on your behalf.

  • AmazonElasticMapReduceEditorsRoleOperator

    Default policy for the Amazon Elastic MapReduce Editors service role.

  • AWSCodeStarServiceRoleAdmin

    DO NOT USE - AWS CodeStar Service Role Policy which grants administrative privileges in order for CodeStar to manage IAM and other service resources on behalf of the customer.

  • AWSFaultInjectionSimulatorEC2AccessOperator

    This policy grants the Fault Injection Simulator Service permission in EC2 and other required services to perform FIS actions.

  • AWSFaultInjectionSimulatorNetworkAccessOperator

    This policy grants the Fault Injection Simulator Service permission in EC2 networking and other required services to perform FIS actions.

  • ROSAControlPlaneOperatorPolicyOperator

    Allows Red Hat OpenShift Service on AWS (ROSA) control plane to manage ROSA cluster Amazon EC2 and Amazon Route 53 resources.

  • ROSAInstallerPolicyOperator

    Allows the Red Hat OpenShift Service on AWS (ROSA) installer to manage AWS resources that support ROSA cluster installation. This includes managing instance profiles for ROSA worker nodes.

  • ROSAKarpenterControllerPolicyOperator

    Provides permissions for the ROSA Karpenter controller to dynamically provision and manage EC2 instances for Red Hat OpenShift Service on AWS (ROSA) hosted control plane clusters. This includes EC2 fleet and instance lifecycle management, i…

  • ROSANodePoolManagementPolicyOperator

    Allows Red Hat OpenShift Service on AWS (ROSA) to manage cluster EC2 instances as worker nodes, including permission to configure security groups and tag instances and volumes. This policy also allows for the use of EC2 instances with disk …

  • ROSASRESupportPolicyOperator

    Provides ROSA site reliability engineering (SRE) the permissions needed to initially observe, diagnose, and support AWS resources associated with Red Hat OpenShift Service on AWS (ROSA) clusters, including the ability to change ROSA cluster…

  • ServerMigration_ServiceRoleOperator

    Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.

  • VMImportExportRoleForAWSConnectorOperator

    Default policy for the VM Import/Export service role, for customers using the AWS Connector. The VM Import/Export service assumes a role with this policy to fulfill virtual machine migration requests from the AWS Connector virtual appliance…

Lambda (3)

  • AWSLambdaENIManagementAccessOperator

    Provides minimum permissions for a Lambda function to manage ENIs (create, describe, delete) used by a VPC-enabled Lambda Function.

  • AWSLambdaMSKExecutionRoleOperator

    Provides permissions required to access MSK Cluster within a VPC, manage ENIs (create, describe, delete) in the VPC and write permissions to CloudWatch Logs.

  • AWSLambdaVPCAccessExecutionRoleOperator

    Provides minimum permissions for a Lambda function to execute while accessing a resource within a VPC - create, describe, delete network interfaces and write permissions to CloudWatch Logs.

Batch (2)

  • AWSBatchServiceEventTargetRoleOperator

    Policy to enable CloudWatch Event Target for AWS Batch Job Submission

  • AWSBatchServiceRoleOperator

    Policy for AWS Batch service role which allows access to related services including EC2, Autoscaling, EC2 Container service and Cloudwatch Logs.

Config (2)

  • AWS_ConfigRoleOperator

    Default policy for AWS Config service role. Provides permissions required for AWS Config to track changes to your AWS resources.

  • ROSACloudNetworkConfigOperatorPolicyOperator

    Allows the OpenShift Cloud Network Config Controller Operator to provision and manage networking resources for use by the Red Hat OpenShift Service on AWS (ROSA) cluster networking overlay. The OpenShift Cloud Network Operator interfaces wi…

Data Lifecycle Manager (2)

Elastic Beanstalk (2)

Elastic Block Store (2)

  • AmazonEBSCSIDriverPolicyOperator

    IAM Policy that allows the CSI driver service account to make calls to related services such as EC2 on your behalf.

  • ROSAAmazonEBSCSIDriverOperatorPolicyOperator

    Allows the OpenShift Amazon EBS Container Storage Interface (CSI) Driver Operator to install and maintain the Amazon EBS CSI driver on a Red Hat OpenShift Service on AWS (ROSA) cluster. The Amazon EBS CSI driver allows ROSA clusters to mana…

Other services (15)

  • AmazonDMSVPCManagementRoleOperator

    Provides access to manage VPC settings for AWS managed customer configurations

  • AmazonECSInfrastructureRolePolicyForVolumesOperator

    Provides access to other AWS service resources required to manage volumes associated with ECS workloads on your behalf.

  • AmazonEMRServicePolicy_v2Operator

    This policy is used for the Amazon EMR Service Role and should NOT be used for any other IAM users or roles in your account. The policy grants permissions to create and manage resources associated with EMR and related services necessary for…

  • AmazonSageMakerQuickSightVPCPolicyOperator

    This policy will be used By SageMaker Unified Studios to create VPC related resources for QuickSight

  • AWSApplicationMigrationFSxProxyVPCPolicyOperator

    Provides permissions to manage PrivateLink between AWS Application Migration Service and customer's FSx file system

  • AWSCloudHSMRoleOperator

    Default policy for the AWS CloudHSM service role.

  • AWSCodeDeployRoleOperator

    Provides CodeDeploy service access to expand tags and interact with Auto Scaling on your behalf.

  • AWSElasticDisasterRecoveryNetworkReplicationPolicyReader

    This policy allows AWS Elastic Disaster Recovery (DRS) to support network replication.

  • AWSFaultInjectionSimulatorEKSAccessOperator

    This policy grants the Fault Injection Simulator Service permission in EKS and other required services to perform FIS actions.

  • AWSGlueDataBrewServiceRoleOperator

    This policy grants permission to glue to perform action on user's glue data catalog, this policy also provides permission to ec2 actions to allow glue to create ENI to connect to resources in the VPC, also allow glue to access registered da…

  • AWSMigrationHubRefactorSpaces-SSMAutomationPolicyOperator

    Use in the IAM service role passed to the SSM Automation document AWSRefactorSpaces-CreateResources to grant permissions required to run the automation. The policy grants read/write access to EC2 tags in order to track automation progress. …

  • AWSTransformApplicationDeploymentPolicyOperator

    Enables the AWS Transform service to deploy transformed .NET applications by creating and managing AWS resources. This policy grants permissions to provision infrastructure, manage compute resources, and configure deployment settings across…

  • CloudWatchEventsBuiltInTargetExecutionAccessOperator

    Allows built-in targets in Amazon CloudWatch Events to perform EC2 actions on your behalf.

  • EC2ImageBuilderLifecycleExecutionPolicyOperator

    The EC2ImageBuilderLifecycleExecutionPolicy policy grants permissions for Image Builder to perform actions such as deprecate or delete Image Builder image resources and their underlying resources (AMIs, snapshots) to support automated rules…

  • ServerMigrationServiceLaunchRoleOperator

    Permissions to allow the AWS Server Migration Service to create and update relevant AWS resources into the customer's AWS account for launching migrated servers and applications.

Service-linked roles (105)

EC2 (27)

RDS (5)

EKS (4)

CloudWatch (3)

  • CloudWatchEventsServiceRolePolicyOperator

    Allow AWS CloudWatch to execute actions on your behalf configured through alarms and events.

  • CloudWatchNetworkFlowMonitorTopologyServiceRolePolicyOperator

    You can't attach CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor\_Topology, which generates topology snapshots of resourc…

  • CloudWatchNetworkMonitorServiceRolePolicyOperator

    Allows CloudWatch Network Monitor to access and manage EC2 and VPC resources, publish data to CloudWatch and access other required services on your behalf.

EMR (3)

Inspector (3)

OpenSearch (3)

SageMaker (3)

Auto Scaling (2)

Bedrock (2)

Device Farm (2)

Elastic Container Service (2)

GuardDuty (2)

  • AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator

    GuardDuty malware protection uses the service-linked role (SLR) named AWSServiceRoleForAmazonGuardDutyMalwareProtection. This service-linked role allows GuardDuty malware protection to perform agent-less scans to detect malware. It allows G…

  • AmazonGuardDutyServiceRolePolicyOperator

    Enable access to AWS Resources used or managed by Amazon Guard Duty

MSK (2)

Network Firewall (2)

Network Manager (2)

Outposts (2)

Route 53 (2)

Other services (34)

Also relevant to Compute (160)
  • AmazonBraketFullAccessAdmin

    Provides full access to Amazon Braket via the AWS Management Console and SDK. Also provides access to related services (e.g., S3, logs).

  • AmazonDataZoneEnvironmentRolePermissionsBoundaryAdmin

    Amazon DataZone creates IAM roles for Environments to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator

    Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneProjectRolePermissionsBoundaryAdmin

    Amazon DataZone creates IAM roles for projects to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneSageMakerProvisioningRolePolicyOperator

    The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.

  • AmazonDocDBConsoleFullAccessAdmin

    Provides full access to manage Amazon DocumentDB with MongoDB compatibility using the AWS Management Console. Note this policy also grants full access to publish on all SNS topics within the account, permissions to create and edit Amazon EC…

  • AmazonDocDBElasticFullAccessAdmin

    Provides full access to Amazon DocumentDB Elastic Clusters and other required permissions for its dependencies including EC2, KMS, SecretsManager, CloudWatch and IAM.

  • AmazonDocDBReadOnlyAccessReader

    Provides read-only access to Amazon DocumentDB with MongoDB compatibility. Note that this policy also grants access to Amazon RDS and Amazon Neptune resources.

  • AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin

    Default policy for the Amazon EC2 Role for Data Pipeline service role.

  • AmazonEC2SpotFleetAutoscaleRoleOperator

    Policy to enable Autoscaling for Amazon EC2 Spot Fleet

  • AmazonECSInfrastructureRoleforExpressGatewayServicesOperator

    These permissions enable Amazon ECS to automatically provision and manage the infrastructure components required for Express Gateway Services, including load balancing, security groups, SSL certificates, and auto scaling configurations.

  • AmazonECSInfrastructureRoleForGatewayHostSharedALBOperator

    Default policy for the Amazon ECS Infrastructure Role for Amazon ECS Service Gateway Services.

  • AmazonECSInfrastructureRolePolicyForVpcLatticeOperator

    Provides access to other AWS service resources required to manage VPC Lattice feature in ECS workloads on your behalf.

  • AmazonEFSCSIDriverPolicyOperator

    Provides management access to EFS resources and read access to EC2

  • AmazonEKSClusterPolicyOperator

    This policy provides Kubernetes the permissions it requires to manage resources on your behalf. Kubernetes requires Ec2:CreateTags permissions to place identifying information on EC2 resources including but not limited to Instances, Securit…

  • AmazonEKSLoadBalancingPolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's load balancing resources.

  • AmazonEKSLocalOutpostClusterPolicyOperator

    This policy provides permissions to EKS local cluster's control-plane instances running in your account to manage resources on your behalf.

  • AmazonEKSMCPReadOnlyAccessAnalyst

    Provides read-only access to the Amazon EKS MCP service. This policy grants permissions to use only read-only tools in the EKS MCP service meant for observability, troubleshooting, retrieving EKS resource information, and getting EKS-optimi…

  • AmazonElasticFileSystemFullAccessAdmin

    Provides full access to Amazon EFS via the AWS Management Console.

  • AmazonElasticFileSystemReadOnlyAccessReader

    Provides read only access to Amazon EFS via the AWS Management Console.

  • AmazonElasticFileSystemServiceRolePolicyOperator

    Allows Amazon Elastic File System to manage AWS resources on your behalf

  • AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin

    Default policy for the Amazon Elastic MapReduce for EC2 service role.

  • AmazonElasticMapReduceRoleHigh privilegeOperator

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Default policy for the Amazon Elastic MapReduce service role.

  • AmazonEMRFullAccessPolicy_v2Operator

    Provides full access to Amazon EMR

  • AmazonEMRServicePolicyForSessionsOperator

    Provides permissions to provision and manage Network Load Balancers, VPC endpoint services, and security groups required for Amazon EMR Spark Connect interactive sessions on EMR on EC2 clusters.

  • AmazonFSxConsoleFullAccessAdmin

    Provides full access to Amazon FSx and access to related AWS services via the AWS Management Console.

  • AmazonFSxConsoleReadOnlyAccessReader

    Provides read only access to Amazon FSx and access to related AWS services via the AWS Management Console.

  • AmazonGrafanaCloudWatchAccessAnalyst

    This policy grants access to Amazon CloudWatch and the dependencies needed to use CloudWatch as a datasource within Amazon Managed Grafana.

  • AmazonInspector2AmiScanServiceRolePolicyOperator

    Grants Amazon Inspector access to AWS services needed to perform security assessments for AMI

  • AmazonKeyspacesReadOnlyAccess_v2Reader

    Provide read only access to Amazon Keyspaces and related AWS services.

  • AmazonLaunchWizardFullAccessV2Admin

    Full access to AWS Launch wizard and other required services.

  • AmazonMachineLearningRoleforRedshiftDataSourceV3Operator

    Allows Machine Learning to configure and use your Redshift Clusters and S3 Staging Locations for Redshift Data Source.

  • AmazonManagedBlockchainConsoleFullAccessAdmin

    Provides full access to Amazon Managed Blockchain via the AWS Management Console

  • AmazonMQApiFullAccessAdmin

    Provides full access to AmazonMQ via our API/SDK.

  • AmazonMQApiReadOnlyAccessReader

    Provides read only access to AmazonMQ via our API/SDK.

  • AmazonMQFullAccessAdmin

    Provides full access to AmazonMQ via the AWS Management Console.

  • AmazonMQReadOnlyAccessReader

    Provides read only access to AmazonMQ via the AWS Management Console.

  • AmazonMQServiceRolePolicyOperator

    Service Linked Role Policy for AWS Amazon MQ

  • AmazonMSKFullAccessAdmin

    Provide full access to Amazon MSK and other required permissions for its dependencies.

  • AmazonMSKReadOnlyAccessReader

    Provide readonly access to Amazon MSK

  • AmazonNimbleStudio-StudioAdminOperator

    This policy grants access to Amazon Nimble Studio resources associated with the studio admin and related studio resources in other services. Attach this policy to the Admin role associated with your studio.

  • AmazonNimbleStudio-StudioUserOperator

    This policy grants access to Amazon Nimble Studio resources associated with the studio user and related studio resources in other services. Attach this policy to the User role associated with your studio.

  • AmazonODBNetworkAdminOperator

    Provides administrative access to networking resources for Oracle Database@AWS

  • AmazonODBServiceRolePolicyOperator

    Allows Oracle Database@AWS to manage AWS resources on your behalf.

  • AmazonRDSCustomInstanceProfileRolePolicyOperator

    Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.

  • AmazonRDSReadOnlyAccessReader

    Provides read only access to Amazon RDS via the AWS Management Console.

  • AmazonRoute53ResolverFullAccessAdmin

    Full access policy for Route 53 Resolver

  • AmazonRoute53ResolverReadOnlyAccessReader

    Read only policy for Route 53 Resolver

  • AmazonS3FilesFullAccessAdmin

    Provides full access to all S3 Files via the AWS Management Console.

  • AmazonS3FilesReadOnlyAccessReader

    Provides read only access to all S3 Files via the AWS Management Console.

  • AmazonS3OutpostsReadOnlyAccessReader

    Provides read only access to Amazon S3 on Outposts via the AWS Management Console.

  • AmazonSageMakerGroundTruthExecutionOperator

    Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job

  • AmazonSageMakerHyperPodInferenceAccessOperator

    This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…

  • AmazonSageMakerJobFullAccessOperator

    Provides permissions for Amazon SageMaker job execution roles to access data in Amazon S3, invoke agents through Amazon Bedrock AgentCore, track experiments with MLflow, publish model packages, write logs to Amazon CloudWatch, invoke AWS La…

  • AmazonTimestreamInfluxDBFullAccessOperator

    Provides full administrative access to create, update, delete and list Amazon Timestream InfluxDB instances and create and list parameter groups. Please refer to documentation for additional permissions needed.

  • AmazonTimestreamInfluxDBFullAccessWithoutMarketplaceAccessOperator

    Provides administrative access to manage Amazon Timestream InfluxDB instances and parameter groups except marketplace operations.

  • AmazonWorkDocsReadOnlyAccessReader

    Provides read only access to Amazon WorkDocs via the AWS Management Console

  • AmazonWorkSpacesPoolServiceAccessOperator

    This policy provides AWS WorkSpaces service access to required customer account resources for launching Workspaces Pools

  • AmazonWorkSpacesSecureBrowserReadOnlyReader

    Provides read-only access to Amazon WorkSpaces Secure Browser and its dependencies through the AWS Management Console, SDK, and CLI.

  • AmazonWorkSpacesWebReadOnlyReader

    Provides read-only access to Amazon WorkSpaces Web and its dependencies through the AWS Management Console, SDK, and CLI.

  • AmazonZocaloFullAccessAdmin

    Provides full access to Amazon Zocalo.

  • AWSApplicationAutoscalingEC2SpotFleetRequestPolicyOperator

    Policy granting permissions to Application Auto Scaling to access EC2 Spot Fleet and CloudWatch.

  • AWSApplicationMigrationFullAccessAdmin

    This policy provides permissions to all public APIs of AWS Application Migration Service (MGN), as well as permissions to read KMS key information. Attach this policy to your IAM users or roles.

  • AWSApplicationMigrationReadOnlyAccessReader

    This policy provides permissions to all read-only public APIs of Application Migration Service (MGN), as well as some read-only APIs of other AWS services that are required in order to make full read-only use of the MGN console. Attach this…

  • AWSApplicationMigrationReplicationServerPolicyOperator

    This policy allows the Application Migration Service (MGN) Replication Servers, which are EC2 instances launched by Application Migration Service - to communicate with the MGN service, and to create EBS snapshots in your AWS account. An IAM…

  • AWSAuditManagerServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by AWS Audit Manager

  • AWSBackupGuardDutyRolePolicyForScansOperator

    Provides GuardDuty permission to read your AWS Backup Recovery Points for malware scans

  • AWSBackupServiceLinkedRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForIndexingOperator

    Policy containing permissions necessary for AWS Backup to index recovery points.

  • AWSBackupServiceRolePolicyForRestoresOperator

    Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…

  • AWSBackupServiceRolePolicyForScansOperator

    Provides AWS Backup permission to perform malware scans on your AWS Backup Recovery Points

  • AWSBedrockAgentCoreGatewayNetworkServiceRolePolicyOperator

    Allows Bedrock AgentCore Gateway to managed VPC Lattice resources on your behalf

  • AWSBedrockAgentCoreIdentityNetworkServiceRolePolicyOperator

    Allows Bedrock AgentCore Identity to managed VPC Lattice resources on your behalf

  • AWSCloud9AdministratorAdmin

    Provides administrator access to AWS Cloud9.

  • AWSCloud9UserOperator

    Provides permission to create AWS Cloud9 development environments and to manage owned environments.

  • AWSCodeStarFullAccessReader

    Provides full access to AWS CodeStar via the AWS Management Console.

  • AWSContinuumCollectorServiceRolePolicyOperator

    Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.

  • AWSDeepRacerCloudFormationAccessPolicyAdmin

    Allows CloudFormation to create and manage AWS stacks and resources on your behalf.

  • AWSDirectoryServiceFullAccessAdmin

    Provides full access to AWS Directory Service.

  • AWSEC2SqlHaServiceRolePolicyOperator

    EC2 SQL High Availability service permissions to detect standby/passive instances

  • AWSElasticBeanstalkCustomPlatformforEC2RoleOperator

    Provide the instance in your custom platform builder environment permission to launch EC2 instance, create EBS snapshot and AMI, stream logs to Amazon CloudWatch Logs, and store artifacts in Amazon S3.

  • AWSElasticBeanstalkMulticontainerDockerOperator

    Provide the instances in your multicontainer Docker environment access to use the Amazon EC2 Container Service to manage container deployment tasks.

  • AWSElasticBeanstalkServiceHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html. AWS Elastic Beanstalk Service role policy which grants permissions to create & manage resourc…

  • AWSElasticBeanstalkServiceRolePolicyOperator

    AWS Elastic Beanstalk Service Linked Role policy which grants permissions to create & manage resources (i.e.: AutoScaling, EC2, S3, CloudFormation, ELB, etc.) on your behalf.

  • AWSElasticDisasterRecoveryConsoleFullAccessAdmin

    This policy provides full access to all public APIs of AWS Elastic Disaster Recovery (DRS), as well as permissions to read KMS key, License Manager, Resource Groups, Elastic Load Balancing, IAM, and EC2 information. Attach this policy to yo…

  • AWSElasticDisasterRecoveryConsoleFullAccess_v2Admin

    This policy provides full access to all public APIs of AWS Elastic Disaster Recovery (AWS DRS), as well as all public APIs in other AWS services used by AWS DRS Console. Attach this policy to your users or roles.

  • AWSElasticDisasterRecoveryCrossAccountReplicationPolicyOperator

    This policy allows AWS Elastic Disaster Recovery (DRS) to support cross-account replication and cross-account failback.

  • AWSElasticDisasterRecoveryReadOnlyAccessReader

    You can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities. This policy provides permissions to all read-only public APIs of Elastic Disaster Recovery (DRS), as well as some read-only APIs of other AWS service…

  • AWSElasticDisasterRecoveryReplicationServerPolicyOperator

    This policy is attached to the Elastic Disaster Recovery Replication server's instance role. This policy allows the Elastic Disaster Recovery (DRS) Replication Servers, which are EC2 instances launched by Elastic Disaster Recovery - to comm…

  • AWSElasticDisasterRecoveryStagingAccountPolicyOperator

    This policy allows read-only access to AWS Elastic Disaster Recovery (DRS) resources such as source servers and jobs. It also allows creating a converted snapshot and sharing that EBS snapshot with a specific account.

  • AWSElasticDisasterRecoveryStagingAccountPolicy_v2Operator

    This policy is used by AWS Elastic Disaster Recovery (DRS) to recover source servers into a separate target account and to allow failing back. We do not recommend that you attach this policy to your IAM users or roles.

  • AWSFaultInjectionSimulatorECSAccessOperator

    This policy grants the Fault Injection Simulator Service permission in ECS and other required services to perform FIS actions.

  • AWSIncidentManagerIncidentAccessServiceRolePolicyReader

    Grants Incident Manager permissions to call other AWS services as a part of managing an incident.

  • AWSIoTDeviceTesterForFreeRTOSFullAccessOperator

    Allows AWS IoT Device Tester to run the FreeRTOS qualification suite by allowing access to services including IoT, S3, and IAM

  • AWSLicenseManagerLinuxSubscriptionsServiceRolePolicyOperator

    Allows AWS License Manager Linux Subscriptions Service to manage resources on your behalf.

  • AWSManagedServices_ContactsServiceRolePolicyReader

    Allows AWS Managed Services to read the values of the tags on AWS resources

  • AWSMarketplaceFullAccessAdmin

    Provides the ability to subscribe and unsubscribe to AWS Marketplace software, allows users to manage Marketplace software instances from the Marketplace 'Your Software' page, and provides administrative access to EC2.

  • AWSMarketplaceRead-onlyReader

    Provides the ability to review AWS Marketplace subscriptions

  • AWSMarketplaceSellerProductsFullAccessOperator

    Provides sellers full access to AWS Marketplace Management Products page and other AWS services such as AMI management.

  • AWSMarketplaceSellerProductsReadOnlyReader

    Provide sellers read-only access to AWS Marketplace Management Products page.

  • AWSMediaConnectServicePolicyOperator

    The default policy that enables access to AWS services and Resources used or managed by MediaConnect.

  • AWSMigrationHubDiscoveryAccessOperator

    Policy allows AWSMigrationHubService to call AWSApplicationDiscoveryService on behalf of the customer.

  • AWSMigrationHubOrchestratorServiceRolePolicyOperator

    Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads

  • AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccessAdmin

    Grants full access to AWS Migration Hub Refactor Spaces and other AWS related services except AWS Transit Gateway and EC2 security groups not required when using environments without a network bridge. This policy also excludes permissions r…

  • AWSMigrationHubRefactorSpacesServiceRolePolicyOperator

    Provides access to AWS Resources managed or used by AWS Migration Hub Refactor Spaces.

  • AWSMobileHub_FullAccessOperator

    This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

  • AWSNetworkFirewallFullAccessOperator

    Grants full access to AWS Network Firewall service, including permissions to create, configure, manage, and delete firewall resources, policies, and rule groups. Additionally includes permissions to modify VPC endpoints, S3 bucket policies,…

  • AWSPartnerLedSupportReadOnlyAccessOperator

    This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci…

  • AWSQuickSetupDistributorPermissionsBoundaryOperator

    QuickSetup creates IAM roles which enable it to configure the Systems Manager Distributor feature on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSQuickSetupManagedInstanceProfileExecutionPolicyOperator

    This policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup capability and attach it to Amazon EC2 instances that don't already have an instance. profile attached.

  • AWSQuickSetupPatchPolicyTagManagementExecutionPolicyOperator

    Grants permissions to track which instances are managed by Quick Setup patch policy configurations through automated tagging and inventory collection.

  • AWSQuickSetupSchedulerPermissionsBoundaryOperator

    The AWSQuickSetupSchedulerPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure scheduled operations on …

  • AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator

    Quick Setup creates IAM roles which enable it to configure the Host Manager Quick Setup type on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSRefactoringToolkitFullAccessOperator

    This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d…

  • AWSResilienceHubAsssessmentExecutionPolicyOperator

    Policy for AWS Resilience Hub service role which allows access to other AWS services in order to execute assessment.

  • AWSResourceExplorerServiceRolePolicyOperator

    Allows Resource Explorer to view resources and CloudTrail events on your behalf to index your resources for search.

  • AWSResourceGroupsReadOnlyAccessReader

    This is the read only policy for AWS Resource Groups

  • AWSRoboMakerServicePolicyOperator

    RoboMaker service policy

  • AWSRoboMakerServiceRolePolicyOperator

    RoboMaker service policy

  • AWSSecurityAgentServiceRolePolicyOperator

    Allows AWS Security Agent to manage resources on your behalf.

  • AWSServiceRoleForAIDevOpsPolicyOperator

    This Service Linked Role provides AIDevOps ability to provide usage information.

  • AWSServiceRoleForSMSOperator

    Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.

  • AWSServiceRolePolicyForBackupRestoreTestingOperator

    This policy contains permissions for testing restores and for cleaning up resources created during tests.

  • AWSSSMForSAPServiceLinkedRolePolicyOperator

    Provides AWS Systems Manager for SAP with the permissions needed to manage and integrate SAP software with AWS.

  • AWSThinkboxAWSPortalWorkerPolicyOperator

    This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.

  • AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator

    Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.

  • AWSTransformInfrastructureExecutorAccessEC2Operator

    Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, re…

  • AWSTransformServerMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

  • AWSVPCFlowLogsServiceRolePolicyOperator

    Provides permissions to control service managed resources and call APIs necessary for log field enrichment on behalf of customers.

  • AWSZonalAutoshiftPracticeRunSLRPolicyOperator

    Provides administrative access for ARC zonal shift practice runs, and access to CloudWatch alarm statuses to monitor practice runs.

  • CloudWatchAgentServerPolicyOperator

    Permissions required to use AmazonCloudWatchAgent on servers

  • CloudWatchAutomaticDashboardsAccessReader

    Provides access to the non-CloudWatch APIs used to display CloudWatch Automatic Dashboards, including the contents of objects such as Lambda functions

  • CloudWatchInternetMonitorServiceRolePolicyOperator

    Allows Internet Monitor to access EC2, Workspaces, and CloudFront resources, and other required services on your behalf.

  • CloudWatchOmniAWSIntegrationPolicyOperator

    Provides permissions required by CloudWatch Omni to discover and read AWS resource topology

  • ComputeOptimizerReadOnlyAccessReader

    Provides read only access to ComputeOptimizer.

  • ComputeOptimizerServiceRolePolicyAdmin

    Allows ComputeOptimizer to call AWS services and collect workload details on your behalf.

  • DataScientistHigh privilegeAdmin

    Grants permissions to AWS data analytics services.

  • DBModDiscoveryAndAssessmentOperator

    Discovery and Assessment permissions for database connector used in database modernization

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • EC2InstanceProfileForImageBuilderECRContainerBuildsOperator

    EC2 Instance profile for building container images with EC2 Image Builder. This policy grants the user broad permissions to upload ECR images.

  • ElasticLoadBalancingFullAccessAdmin

    Provides full access to Amazon ElasticLoadBalancing, and limited access to other services necessary to provide ElasticLoadBalancing features.

  • ElasticLoadBalancingReadOnlyReader

    Provides read only access to Amazon ElasticLoadBalancing and dependent services

  • FMSServiceRolePolicyOperator

    Access policy to allow FM service linked role to perform FM-related actions on FM-managed resources within a customer AWS Organization account.

  • GameLiftContainerFleetPolicyOperator

    Grants the required permissions for compute actions in an Amazon GameLift container fleet, including access to dependencies such as Amazon S3.

  • MigrationHubServiceRolePolicyOperator

    Allows Migration Hub to call Application Discovery Service on your behalf

  • NeptuneConsoleFullAccessOperator

    Provides full access to manage Amazon Neptune using the AWS Management Console. Note this policy also grants full access to publish on all SNS topics within the account, permissions to create and edit Amazon EC2 instances and VPC configurat…

  • NeptuneGraphReadOnlyAccessReader

    Provides read only access to all Amazon Neptune Analytics resources along with read only permissions for dependent services.

  • NeptuneReadOnlyAccessReader

    Provides read only access to Amazon Neptune. Note that this policy also grants access to Amazon RDS resources. For more information, see https://aws.amazon.com/neptune/faqs/.

  • NetworkAdministratorAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS network resources.

  • NetworkSecurityManagerServiceRolePolicyOperator

    Access policy to allow NetworkSecurityManager service linked role to perform NetworkSecurityManager-related actions on NetworkSecurityManager-managed resources within a customer AWS account.

  • ROSAKubeControllerPolicyOperator

    Allows the ROSA Kubernetes controller to manage Amazon EC2, Elastic Load Balancing (ELB), and AWS Key Management Service (KMS) resources for a ROSA cluster.

  • ROSAWorkerInstancePolicyReader

    Allows Red Hat OpenShift Service on AWS (ROSA) worker nodes in your account read-only access to Amazon EC2 instances and AWS Regions for compute node lifecycle management.

  • SageMakerStudioAdminIAMConsolePolicyAdmin

    Provides initial administrative and individual setup privileges for Amazon SageMaker Unified Studio via the AWS Management Console and SDK. Allows launching of SageMaker Unified Studio Portal.

  • SageMakerStudioEMRServiceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SecurityAuditOperator

    The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.

  • SupportUserAdmin

    This policy grants permissions to troubleshoot and resolve issues in an AWS account. This policy also enables the user to contact AWS support to create and manage cases.

  • SystemAdministratorHigh privilegeAdmin

    Grants full access permissions necessary for resources required for application and development operations.

  • ViewOnlyAccessOperator

    This policy grants permissions to view resources and basic metadata across all AWS services.

  • VPCLatticeReadOnlyAccessReader

    Provides read-only access to Amazon VPC Lattice via the AWS Management Console, and limited access to dependency services.

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.