Skip to main content
IAM Policy Map

Compute: Operator policies

Virtual servers, scaling, batch and high-performance computing.

197 AWS managed policies. 1 have reviewed guidance; the rest have authoritative permission data pending editorial review. 98 are service-linked role policies, shown with permission data only.

Operator and limited (59)

EC2 (14)

  • AIDevOpsReleaseManagementVPCPolicyOperator

    Provides permissions for AWS DevOps Agent to create and manage network interfaces in your VPC so that release management agents can access private resources

  • AmazonDRSVPCManagementOperator

    Provides access to manage VPC settings for Amazon managed customer configurations

  • AmazonEBSCSIDriverEKSClusterScopedPolicyOperator

    IAM Policy that allows the CSI driver service account to make calls to related services such as EC2 on your behalf. This policy restricts the Amazon EBS CSI driver to only managing EBS volumes and snapshots that belong to a specific EKS clu…

  • AmazonElasticMapReducePlacementGroupPolicyOperator

    Policy to allow EMR to create, describe and delete EC2 placement groups.

  • AmazonVPCFullAccessOperator

    Provides full access to Amazon VPC via the AWS Management Console.

  • AmazonVPCReachabilityAnalyzerFullAccessPolicyOperator

    Provides permissions to describe AWS resources, run Reachability Analyzer, and create or delete tags on Network Insights Path and Network Insights Analysis.

  • AWSConnectorOperator

    Enables broad read/write access to ALL EC2 objects, read/write access to S3 buckets starting with 'import-to-ec2-', and the ability to list all S3 buckets, for the AWS Connector to import VMs on your behalf.

  • AWSEC2VssRestorePolicyOperator

    Grants Amazon EC2 and AWS SSM permissions to restore SQL Server database from application consistent snapshots created by AWS VSS.

  • AWSEC2VssSnapshotPolicyOperator

    This policy is attached to the IAM role that's attached to your Amazon EC2 Windows Instances to enable the Amazon EC2 VSS solution to create and add tags to Amazon Machine Images (AMI) and EBS Snapshots.

  • AWSQuickSetupStartStopInstancesExecutionPolicyOperator

    The managed policy AWSQuickSetupStartStopInstancesExecutionPolicy provides permissions for Quick Setup to start and stop Amazon EC2 instances on a schedule. This policy is used with the Quick Setup scheduler configuration type.

  • AWSThinkboxAWSPortalAdminPolicyOperator

    This policy grants AWS Thinkbox's Deadline software full access to multiple AWS services as required for AWS Portal administration. This includes access to create arbitrary tags on several EC2 resource types.

  • EC2FastLaunchFullAccessOperator

    This policy grants full access to EC2 Fast Launch actions

  • EC2InstanceConnectOperator

    Allows customers to call EC2 Instance Connect to publish ephemeral keys to their EC2 instances and connect via ssh or the EC2 Instance Connect CLI.

  • EC2InstanceProfileForImageBuilderOperator

    EC2 Instance profile for Image Builder service.

Deadline Cloud (8)

  • AWSDeadlineCloud-FleetWorkerOperator

    Provides AWS Deadline Cloud workers with access to run tasks on a farm.

  • AWSDeadlineCloud-UserAccessFarmsOperator

    Provides user workstation access to AWS Deadline Cloud farms with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessFleetsOperator

    Provides user workstation access to AWS Deadline Cloud fleets with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessJobsOperator

    Provides user workstation access to AWS Deadline Cloud jobs with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-UserAccessQueuesOperator

    Provides user workstation access to AWS Deadline Cloud queues with limited Read-Only permissions to call other necessary services. Attach this policy to the user role associated with your studio.

  • AWSDeadlineCloud-WorkerHostOperator

    Provides access for AWS Deadline Cloud worker hosts to join a fleet in a farm.

  • AWSThinkboxDeadlineSpotEventPluginAdminPolicyOperator

    Grants permissions required for AWS Thinkbox's Deadline Spot Event Plugin. This includes permission to request, modify, and cancel a spot fleet, as well as limited PassRole permission.

  • AWSThinkboxDeadlineSpotEventPluginWorkerPolicyOperator

    Grant permissions required for an EC2 instance running AWS Thinkbox Deadline Spot Event Plugin Worker software.

EKS (7)

  • AmazonEKS_CNI_PolicyOperator

    This policy provides the Amazon VPC CNI Plugin (amazon-vpc-cni-k8s) the permissions it requires to modify the IP address configuration on your EKS worker nodes. This permission set allows the CNI to list, describe, and modify Elastic Networ…

  • AmazonEKSBlockStoragePolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's block storage resources.

  • AmazonEKSBlockStoragePolicyV2Operator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's block storage resources.

  • AmazonEKSComputePolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's compute resources.

  • AmazonEKSNetworkingPolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's networking resources.

  • AmazonEKSServicePolicyOperator

    This policy allows Amazon Elastic Container Service for Kubernetes to create and manage the necessary resources to operate EKS Clusters.

  • AmazonEKSVPCResourceControllerOperator

    Policy used by VPC Resource Controller to manage ENI and IPs for worker nodes.

Application Migration Service (3)

Account (2)

Lambda (2)

Marketplace (2)

  • AWSMarketplaceAmiIngestionOperator

    Allows AWS Marketplace to copy your Amazon Machine Images (AMIs) in order to list them on AWS Marketplace

  • AWSMarketplaceImageBuildFullAccessOperator

    Provides full access to AWS Marketplace Private Image Build Feature. In addition to create private images, it also provides permissions to add tags to images, launch and terminate ec2 instances.

Systems Manager (2)

  • AWS-SSM-DiagnosisAutomation-ExecutionRolePolicyOperator

    Provide permission for Diagnosing issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by diagnosing SSM service health ac…

  • AWS-SSM-RemediationAutomation-ExecutionRolePolicyOperator

    Provides permissions for Remediating issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by remediating SSM services heal…

Transform (2)

  • AWSTransformInfrastructureExecutorAccessBatchOperator

    Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch jo…

  • AWSTransformNetworkMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration

Other services (17)

Service roles (40)

EC2 (13)

  • AmazonAppStreamServiceAccessOperator

    Default policy for Amazon AppStream service role.

  • AmazonEC2ContainerServiceRoleOperator

    Default policy for Amazon ECS service role.

  • AmazonEC2SpotFleetTaggingRoleOperator

    Allows EC2 Spot Fleet to request, terminate and tag Spot Instances on your behalf.

  • AmazonElasticMapReduceEditorsRoleOperator

    Default policy for the Amazon Elastic MapReduce Editors service role.

  • AWSFaultInjectionSimulatorEC2AccessOperator

    This policy grants the Fault Injection Simulator Service permission in EC2 and other required services to perform FIS actions.

  • AWSFaultInjectionSimulatorNetworkAccessOperator

    This policy grants the Fault Injection Simulator Service permission in EC2 networking and other required services to perform FIS actions.

  • ROSAControlPlaneOperatorPolicyOperator

    Allows Red Hat OpenShift Service on AWS (ROSA) control plane to manage ROSA cluster Amazon EC2 and Amazon Route 53 resources.

  • ROSAInstallerPolicyOperator

    Allows the Red Hat OpenShift Service on AWS (ROSA) installer to manage AWS resources that support ROSA cluster installation. This includes managing instance profiles for ROSA worker nodes.

  • ROSAKarpenterControllerPolicyOperator

    Provides permissions for the ROSA Karpenter controller to dynamically provision and manage EC2 instances for Red Hat OpenShift Service on AWS (ROSA) hosted control plane clusters. This includes EC2 fleet and instance lifecycle management, i…

  • ROSANodePoolManagementPolicyOperator

    Allows Red Hat OpenShift Service on AWS (ROSA) to manage cluster EC2 instances as worker nodes, including permission to configure security groups and tag instances and volumes. This policy also allows for the use of EC2 instances with disk …

  • ROSASRESupportPolicyOperator

    Provides ROSA site reliability engineering (SRE) the permissions needed to initially observe, diagnose, and support AWS resources associated with Red Hat OpenShift Service on AWS (ROSA) clusters, including the ability to change ROSA cluster…

  • ServerMigration_ServiceRoleOperator

    Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.

  • VMImportExportRoleForAWSConnectorOperator

    Default policy for the VM Import/Export service role, for customers using the AWS Connector. The VM Import/Export service assumes a role with this policy to fulfill virtual machine migration requests from the AWS Connector virtual appliance…

Lambda (3)

  • AWSLambdaENIManagementAccessOperator

    Provides minimum permissions for a Lambda function to manage ENIs (create, describe, delete) used by a VPC-enabled Lambda Function.

  • AWSLambdaMSKExecutionRoleOperator

    Provides permissions required to access MSK Cluster within a VPC, manage ENIs (create, describe, delete) in the VPC and write permissions to CloudWatch Logs.

  • AWSLambdaVPCAccessExecutionRoleOperator

    Provides minimum permissions for a Lambda function to execute while accessing a resource within a VPC - create, describe, delete network interfaces and write permissions to CloudWatch Logs.

Batch (2)

  • AWSBatchServiceEventTargetRoleOperator

    Policy to enable CloudWatch Event Target for AWS Batch Job Submission

  • AWSBatchServiceRoleOperator

    Policy for AWS Batch service role which allows access to related services including EC2, Autoscaling, EC2 Container service and Cloudwatch Logs.

Config (2)

  • AWS_ConfigRoleOperator

    Default policy for AWS Config service role. Provides permissions required for AWS Config to track changes to your AWS resources.

  • ROSACloudNetworkConfigOperatorPolicyOperator

    Allows the OpenShift Cloud Network Config Controller Operator to provision and manage networking resources for use by the Red Hat OpenShift Service on AWS (ROSA) cluster networking overlay. The OpenShift Cloud Network Operator interfaces wi…

Data Lifecycle Manager (2)

Elastic Beanstalk (2)

Elastic Block Store (2)

  • AmazonEBSCSIDriverPolicyOperator

    IAM Policy that allows the CSI driver service account to make calls to related services such as EC2 on your behalf.

  • ROSAAmazonEBSCSIDriverOperatorPolicyOperator

    Allows the OpenShift Amazon EBS Container Storage Interface (CSI) Driver Operator to install and maintain the Amazon EBS CSI driver on a Red Hat OpenShift Service on AWS (ROSA) cluster. The Amazon EBS CSI driver allows ROSA clusters to mana…

Other services (14)

  • AmazonDMSVPCManagementRoleOperator

    Provides access to manage VPC settings for AWS managed customer configurations

  • AmazonECSInfrastructureRolePolicyForVolumesOperator

    Provides access to other AWS service resources required to manage volumes associated with ECS workloads on your behalf.

  • AmazonEMRServicePolicy_v2Operator

    This policy is used for the Amazon EMR Service Role and should NOT be used for any other IAM users or roles in your account. The policy grants permissions to create and manage resources associated with EMR and related services necessary for…

  • AmazonSageMakerQuickSightVPCPolicyOperator

    This policy will be used By SageMaker Unified Studios to create VPC related resources for QuickSight

  • AWSApplicationMigrationFSxProxyVPCPolicyOperator

    Provides permissions to manage PrivateLink between AWS Application Migration Service and customer's FSx file system

  • AWSCloudHSMRoleOperator

    Default policy for the AWS CloudHSM service role.

  • AWSCodeDeployRoleOperator

    Provides CodeDeploy service access to expand tags and interact with Auto Scaling on your behalf.

  • AWSFaultInjectionSimulatorEKSAccessOperator

    This policy grants the Fault Injection Simulator Service permission in EKS and other required services to perform FIS actions.

  • AWSGlueDataBrewServiceRoleOperator

    This policy grants permission to glue to perform action on user's glue data catalog, this policy also provides permission to ec2 actions to allow glue to create ENI to connect to resources in the VPC, also allow glue to access registered da…

  • AWSMigrationHubRefactorSpaces-SSMAutomationPolicyOperator

    Use in the IAM service role passed to the SSM Automation document AWSRefactorSpaces-CreateResources to grant permissions required to run the automation. The policy grants read/write access to EC2 tags in order to track automation progress. …

  • AWSTransformApplicationDeploymentPolicyOperator

    Enables the AWS Transform service to deploy transformed .NET applications by creating and managing AWS resources. This policy grants permissions to provision infrastructure, manage compute resources, and configure deployment settings across…

  • CloudWatchEventsBuiltInTargetExecutionAccessOperator

    Allows built-in targets in Amazon CloudWatch Events to perform EC2 actions on your behalf.

  • EC2ImageBuilderLifecycleExecutionPolicyOperator

    The EC2ImageBuilderLifecycleExecutionPolicy policy grants permissions for Image Builder to perform actions such as deprecate or delete Image Builder image resources and their underlying resources (AMIs, snapshots) to support automated rules…

  • ServerMigrationServiceLaunchRoleOperator

    Permissions to allow the AWS Server Migration Service to create and update relevant AWS resources into the customer's AWS account for launching migrated servers and applications.

Service-linked roles (98)

EC2 (25)

RDS (5)

EKS (4)

CloudWatch (3)

  • CloudWatchEventsServiceRolePolicyOperator

    Allow AWS CloudWatch to execute actions on your behalf configured through alarms and events.

  • CloudWatchNetworkFlowMonitorTopologyServiceRolePolicyOperator

    You can't attach CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor\_Topology, which generates topology snapshots of resourc…

  • CloudWatchNetworkMonitorServiceRolePolicyOperator

    Allows CloudWatch Network Monitor to access and manage EC2 and VPC resources, publish data to CloudWatch and access other required services on your behalf.

EMR (3)

Inspector (2)

OpenSearch (3)

SageMaker (3)

Auto Scaling (2)

Bedrock (2)

Device Farm (2)

Elastic Container Service (2)

GuardDuty (2)

  • AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator

    GuardDuty malware protection uses the service-linked role (SLR) named AWSServiceRoleForAmazonGuardDutyMalwareProtection. This service-linked role allows GuardDuty malware protection to perform agent-less scans to detect malware. It allows G…

  • AmazonGuardDutyServiceRolePolicyOperator

    Enable access to AWS Resources used or managed by Amazon Guard Duty

MSK (2)

Network Firewall (2)

Network Manager (1)

Outposts (2)

Route 53 (2)

Other services (31)

Also relevant to Compute (96)
  • AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator

    Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneSageMakerProvisioningRolePolicyOperator

    The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.

  • AmazonEC2SpotFleetAutoscaleRoleOperator

    Policy to enable Autoscaling for Amazon EC2 Spot Fleet

  • AmazonECSInfrastructureRoleforExpressGatewayServicesOperator

    These permissions enable Amazon ECS to automatically provision and manage the infrastructure components required for Express Gateway Services, including load balancing, security groups, SSL certificates, and auto scaling configurations.

  • AmazonECSInfrastructureRoleForGatewayHostSharedALBOperator

    Default policy for the Amazon ECS Infrastructure Role for Amazon ECS Service Gateway Services.

  • AmazonECSInfrastructureRolePolicyForVpcLatticeOperator

    Provides access to other AWS service resources required to manage VPC Lattice feature in ECS workloads on your behalf.

  • AmazonEFSCSIDriverPolicyOperator

    Provides management access to EFS resources and read access to EC2

  • AmazonEKSClusterPolicyOperator

    This policy provides Kubernetes the permissions it requires to manage resources on your behalf. Kubernetes requires Ec2:CreateTags permissions to place identifying information on EC2 resources including but not limited to Instances, Securit…

  • AmazonEKSLoadBalancingPolicyOperator

    Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's load balancing resources.

  • AmazonEKSLocalOutpostClusterPolicyOperator

    This policy provides permissions to EKS local cluster's control-plane instances running in your account to manage resources on your behalf.

  • AmazonElasticFileSystemServiceRolePolicyOperator

    Allows Amazon Elastic File System to manage AWS resources on your behalf

  • AmazonElasticMapReduceRoleHigh privilegeOperator

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Default policy for the Amazon Elastic MapReduce service role.

  • AmazonEMRFullAccessPolicy_v2Operator

    Provides full access to Amazon EMR

  • AmazonEMRServicePolicyForSessionsOperator

    Provides permissions to provision and manage Network Load Balancers, VPC endpoint services, and security groups required for Amazon EMR Spark Connect interactive sessions on EMR on EC2 clusters.

  • AmazonInspector2AmiScanServiceRolePolicyOperator

    Grants Amazon Inspector access to AWS services needed to perform security assessments for AMI

  • AmazonMachineLearningRoleforRedshiftDataSourceV3Operator

    Allows Machine Learning to configure and use your Redshift Clusters and S3 Staging Locations for Redshift Data Source.

  • AmazonMQServiceRolePolicyOperator

    Service Linked Role Policy for AWS Amazon MQ

  • AmazonNimbleStudio-StudioAdminOperator

    This policy grants access to Amazon Nimble Studio resources associated with the studio admin and related studio resources in other services. Attach this policy to the Admin role associated with your studio.

  • AmazonNimbleStudio-StudioUserOperator

    This policy grants access to Amazon Nimble Studio resources associated with the studio user and related studio resources in other services. Attach this policy to the User role associated with your studio.

  • AmazonODBNetworkAdminOperator

    Provides administrative access to networking resources for Oracle Database@AWS

  • AmazonODBServiceRolePolicyOperator

    Allows Oracle Database@AWS to manage AWS resources on your behalf.

  • AmazonRDSCustomInstanceProfileRolePolicyOperator

    Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.

  • AmazonSageMakerGroundTruthExecutionOperator

    Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job

  • AmazonSageMakerHyperPodInferenceAccessOperator

    This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…

  • AmazonSageMakerJobFullAccessOperator

    Provides permissions for Amazon SageMaker job execution roles to access data in Amazon S3, invoke agents through Amazon Bedrock AgentCore, track experiments with MLflow, publish model packages, write logs to Amazon CloudWatch, invoke AWS La…

  • AmazonTimestreamInfluxDBFullAccessOperator

    Provides full administrative access to create, update, delete and list Amazon Timestream InfluxDB instances and create and list parameter groups. Please refer to documentation for additional permissions needed.

  • AmazonTimestreamInfluxDBFullAccessWithoutMarketplaceAccessOperator

    Provides administrative access to manage Amazon Timestream InfluxDB instances and parameter groups except marketplace operations.

  • AmazonWorkSpacesPoolServiceAccessOperator

    This policy provides AWS WorkSpaces service access to required customer account resources for launching Workspaces Pools

  • AWSApplicationAutoscalingEC2SpotFleetRequestPolicyOperator

    Policy granting permissions to Application Auto Scaling to access EC2 Spot Fleet and CloudWatch.

  • AWSApplicationMigrationReplicationServerPolicyOperator

    This policy allows the Application Migration Service (MGN) Replication Servers, which are EC2 instances launched by Application Migration Service - to communicate with the MGN service, and to create EBS snapshots in your AWS account. An IAM…

  • AWSAuditManagerServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by AWS Audit Manager

  • AWSBackupGuardDutyRolePolicyForScansOperator

    Provides GuardDuty permission to read your AWS Backup Recovery Points for malware scans

  • AWSBackupServiceLinkedRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForIndexingOperator

    Policy containing permissions necessary for AWS Backup to index recovery points.

  • AWSBackupServiceRolePolicyForRestoresOperator

    Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…

  • AWSBackupServiceRolePolicyForScansOperator

    Provides AWS Backup permission to perform malware scans on your AWS Backup Recovery Points

  • AWSBedrockAgentCoreGatewayNetworkServiceRolePolicyOperator

    Allows Bedrock AgentCore Gateway to managed VPC Lattice resources on your behalf

  • AWSBedrockAgentCoreIdentityNetworkServiceRolePolicyOperator

    Allows Bedrock AgentCore Identity to managed VPC Lattice resources on your behalf

  • AWSCloud9UserOperator

    Provides permission to create AWS Cloud9 development environments and to manage owned environments.

  • AWSContinuumCollectorServiceRolePolicyOperator

    Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.

  • AWSEC2SqlHaServiceRolePolicyOperator

    EC2 SQL High Availability service permissions to detect standby/passive instances

  • AWSElasticBeanstalkCustomPlatformforEC2RoleOperator

    Provide the instance in your custom platform builder environment permission to launch EC2 instance, create EBS snapshot and AMI, stream logs to Amazon CloudWatch Logs, and store artifacts in Amazon S3.

  • AWSElasticBeanstalkMulticontainerDockerOperator

    Provide the instances in your multicontainer Docker environment access to use the Amazon EC2 Container Service to manage container deployment tasks.

  • AWSElasticBeanstalkServiceRolePolicyOperator

    AWS Elastic Beanstalk Service Linked Role policy which grants permissions to create & manage resources (i.e.: AutoScaling, EC2, S3, CloudFormation, ELB, etc.) on your behalf.

  • AWSElasticDisasterRecoveryCrossAccountReplicationPolicyOperator

    This policy allows AWS Elastic Disaster Recovery (DRS) to support cross-account replication and cross-account failback.

  • AWSElasticDisasterRecoveryReplicationServerPolicyOperator

    This policy is attached to the Elastic Disaster Recovery Replication server's instance role. This policy allows the Elastic Disaster Recovery (DRS) Replication Servers, which are EC2 instances launched by Elastic Disaster Recovery - to comm…

  • AWSElasticDisasterRecoveryStagingAccountPolicyOperator

    This policy allows read-only access to AWS Elastic Disaster Recovery (DRS) resources such as source servers and jobs. It also allows creating a converted snapshot and sharing that EBS snapshot with a specific account.

  • AWSElasticDisasterRecoveryStagingAccountPolicy_v2Operator

    This policy is used by AWS Elastic Disaster Recovery (DRS) to recover source servers into a separate target account and to allow failing back. We do not recommend that you attach this policy to your IAM users or roles.

  • AWSFaultInjectionSimulatorECSAccessOperator

    This policy grants the Fault Injection Simulator Service permission in ECS and other required services to perform FIS actions.

  • AWSIoTDeviceTesterForFreeRTOSFullAccessOperator

    Allows AWS IoT Device Tester to run the FreeRTOS qualification suite by allowing access to services including IoT, S3, and IAM

  • AWSLicenseManagerLinuxSubscriptionsServiceRolePolicyOperator

    Allows AWS License Manager Linux Subscriptions Service to manage resources on your behalf.

  • AWSMarketplaceSellerProductsFullAccessOperator

    Provides sellers full access to AWS Marketplace Management Products page and other AWS services such as AMI management.

  • AWSMediaConnectServicePolicyOperator

    The default policy that enables access to AWS services and Resources used or managed by MediaConnect.

  • AWSMigrationHubDiscoveryAccessOperator

    Policy allows AWSMigrationHubService to call AWSApplicationDiscoveryService on behalf of the customer.

  • AWSMigrationHubOrchestratorServiceRolePolicyOperator

    Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads

  • AWSMigrationHubRefactorSpacesServiceRolePolicyOperator

    Provides access to AWS Resources managed or used by AWS Migration Hub Refactor Spaces.

  • AWSMobileHub_FullAccessOperator

    This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

  • AWSNetworkFirewallFullAccessOperator

    Grants full access to AWS Network Firewall service, including permissions to create, configure, manage, and delete firewall resources, policies, and rule groups. Additionally includes permissions to modify VPC endpoints, S3 bucket policies,…

  • AWSPartnerLedSupportReadOnlyAccessOperator

    This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci…

  • AWSQuickSetupDistributorPermissionsBoundaryOperator

    QuickSetup creates IAM roles which enable it to configure the Systems Manager Distributor feature on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSQuickSetupManagedInstanceProfileExecutionPolicyOperator

    This policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup capability and attach it to Amazon EC2 instances that don't already have an instance. profile attached.

  • AWSQuickSetupPatchPolicyTagManagementExecutionPolicyOperator

    Grants permissions to track which instances are managed by Quick Setup patch policy configurations through automated tagging and inventory collection.

  • AWSQuickSetupSchedulerPermissionsBoundaryOperator

    The AWSQuickSetupSchedulerPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure scheduled operations on …

  • AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator

    Quick Setup creates IAM roles which enable it to configure the Host Manager Quick Setup type on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSRefactoringToolkitFullAccessOperator

    This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d…

  • AWSResilienceHubAsssessmentExecutionPolicyOperator

    Policy for AWS Resilience Hub service role which allows access to other AWS services in order to execute assessment.

  • AWSResourceExplorerServiceRolePolicyOperator

    Allows Resource Explorer to view resources and CloudTrail events on your behalf to index your resources for search.

  • AWSRoboMakerServicePolicyOperator

    RoboMaker service policy

  • AWSRoboMakerServiceRolePolicyOperator

    RoboMaker service policy

  • AWSSecurityAgentServiceRolePolicyOperator

    Allows AWS Security Agent to manage resources on your behalf.

  • AWSServiceRoleForAIDevOpsPolicyOperator

    This Service Linked Role provides AIDevOps ability to provide usage information.

  • AWSServiceRoleForSMSOperator

    Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.

  • AWSServiceRolePolicyForBackupRestoreTestingOperator

    This policy contains permissions for testing restores and for cleaning up resources created during tests.

  • AWSSSMForSAPServiceLinkedRolePolicyOperator

    Provides AWS Systems Manager for SAP with the permissions needed to manage and integrate SAP software with AWS.

  • AWSThinkboxAWSPortalWorkerPolicyOperator

    This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.

  • AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator

    Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.

  • AWSTransformInfrastructureExecutorAccessEC2Operator

    Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, re…

  • AWSTransformServerMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

  • AWSVPCFlowLogsServiceRolePolicyOperator

    Provides permissions to control service managed resources and call APIs necessary for log field enrichment on behalf of customers.

  • AWSZonalAutoshiftPracticeRunSLRPolicyOperator

    Provides administrative access for ARC zonal shift practice runs, and access to CloudWatch alarm statuses to monitor practice runs.

  • CloudWatchAgentServerPolicyOperator

    Permissions required to use AmazonCloudWatchAgent on servers

  • CloudWatchInternetMonitorServiceRolePolicyOperator

    Allows Internet Monitor to access EC2, Workspaces, and CloudFront resources, and other required services on your behalf.

  • CloudWatchOmniAWSIntegrationPolicyOperator

    Provides permissions required by CloudWatch Omni to discover and read AWS resource topology

  • DBModDiscoveryAndAssessmentOperator

    Discovery and Assessment permissions for database connector used in database modernization

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • EC2InstanceProfileForImageBuilderECRContainerBuildsOperator

    EC2 Instance profile for building container images with EC2 Image Builder. This policy grants the user broad permissions to upload ECR images.

  • FMSServiceRolePolicyOperator

    Access policy to allow FM service linked role to perform FM-related actions on FM-managed resources within a customer AWS Organization account.

  • GameLiftContainerFleetPolicyOperator

    Grants the required permissions for compute actions in an Amazon GameLift container fleet, including access to dependencies such as Amazon S3.

  • MigrationHubServiceRolePolicyOperator

    Allows Migration Hub to call Application Discovery Service on your behalf

  • NeptuneConsoleFullAccessOperator

    Provides full access to manage Amazon Neptune using the AWS Management Console. Note this policy also grants full access to publish on all SNS topics within the account, permissions to create and edit Amazon EC2 instances and VPC configurat…

  • NetworkSecurityManagerServiceRolePolicyOperator

    Access policy to allow NetworkSecurityManager service linked role to perform NetworkSecurityManager-related actions on NetworkSecurityManager-managed resources within a customer AWS account.

  • ROSAKubeControllerPolicyOperator

    Allows the ROSA Kubernetes controller to manage Amazon EC2, Elastic Load Balancing (ELB), and AWS Key Management Service (KMS) resources for a ROSA cluster.

  • SageMakerStudioEMRServiceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SecurityAuditOperator

    The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.

  • ViewOnlyAccessOperator

    This policy grants permissions to view resources and basic metadata across all AWS services.

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.