Containers: Switch between the hub and domains
Containers policies
Container orchestration, registries and managed container platforms.
39 AWS managed policies. 5 have reviewed guidance; the rest have authoritative permission data pending editorial review. 9 are service-linked role policies, shown with permission data only.
Loading map…
Loading map
User access (11)
- AmazonEC2ContainerRegistryFullAccessAdmin
Provides administrative access to Amazon ECR resources
- AmazonEC2ContainerRegistryReadOnlyReader
Provides read-only access to Amazon EC2 Container Registry repositories.
- AmazonEKSFargatePodExecutionRolePolicyReader
Provides access to other AWS service resources that are required to run Amazon EKS pods on AWS Fargate
- AmazonEKSMCPReadOnlyAccessAnalyst
Provides read-only access to the Amazon EKS MCP service. This policy grants permissions to use only read-only tools in the EKS MCP service meant for observability, troubleshooting, retrieving EKS resource information, and getting EKS-optimi…
- AmazonEKSWorkerNodeMinimalPolicyReader
This policy allows Amazon EKS worker nodes to connect to Amazon EKS Clusters.
- AmazonElasticContainerRegistryPublicFullAccessAdmin
Provides administrative access to Amazon ECR Public resources
- AmazonElasticContainerRegistryPublicReadOnlyReader
Provides read-only access to Amazon ECR Public repositories.
- AWSAppRunnerFullAccessAdmin
Grants permissions to all App Runner actions.
- AWSAppRunnerReadOnlyAccessReader
Grants permissions to list and view details about App Runner resources.
- AWSProtonFullAccessAdmin
Provides full access to the AWS Proton APIs and Management Console. In addition to these permissions, access to Amazon S3 is also needed to register template bundles from your S3 buckets, as well as access to Amazon IAM to create and manage…
- AWSProtonReadOnlyAccessReader
Provides read only access to the AWS Proton APIs and Management Console.
Operator and limited (10)
- AmazonEC2ContainerRegistryPowerUserOperator
Provides full access to Amazon EC2 Container Registry repositories, but does not allow repository deletion or policy changes.
- AmazonEC2ContainerRegistryPullOnlyOperator
Provides access to pull images from Amazon EC2 Container Registry repositories.
- AmazonECSInstanceRolePolicyForManagedInstancesOperator
Default policy for the Amazon ECS Instance Role for Amazon ECS Managed Instances.
- AmazonElasticContainerRegistryPublicPowerUserOperator
Provides full access to Amazon ECR Public repositories, but does not allow repository deletion or policy changes.
- AWSApplicationDiscoveryAgentlessCollectorAccessOperator
Allows Application Discovery Service Agentless Collectors to auto update, register, and communicate with Application Discovery Service
- AWSElasticBeanstalkEKSImageBuildOperator
Permissions needed by Elastic Beanstalk to build container images on behalf of customer.
- AWSElasticBeanstalkMulticontainerDockerOperator
Provide the instances in your multicontainer Docker environment access to use the Amazon EC2 Container Service to manage container deployment tasks.
- AWSProtonDeveloperAccessOperator
Provides access to the AWS Proton APIs and Management Console, but does not allow administration of Proton templates or environments.
- AWSRefactoringToolkitFullAccessOperator
This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d…
- EC2InstanceProfileForImageBuilderECRContainerBuildsOperator
EC2 Instance profile for building container images with EC2 Image Builder. This policy grants the user broad permissions to upload ECR images.
Service roles (9)
- AmazonEC2ContainerServiceAutoscaleRoleOperator
Policy to enable Task Autoscaling for Amazon EC2 Container Service
- AmazonEC2ContainerServiceEventsRoleOperator
Policy to enable CloudWatch Events for EC2 Container Service
- AmazonEC2ContainerServiceforEC2RoleOperator
Default policy for the Amazon EC2 Role for Amazon EC2 Container Service.
- AmazonECSTaskExecutionRolePolicyOperator
Provides access to other AWS service resources that are required to run Amazon ECS tasks
- AWSAppRunnerServicePolicyForECRAccessReader
AWS App Runner service policy that grants read permissions to Amazon ECR resources in the customer's account. Use it in a role that is passed to App Runner when creating or updating an App Runner service.
- AWSElasticBeanstalkRoleECSOperator
(Elastic Beanstalk operations role) Allows a multicontainer Docker environment to manage Amazon ECS clusters.
- AWSFaultInjectionSimulatorECSAccessOperator
This policy grants the Fault Injection Simulator Service permission in ECS and other required services to perform FIS actions.
- AWSTransformApplicationECSDeploymentPolicyOperator
Enables the AWS Transform to deploy applications to Amazon Elastic Container Service (ECS) with Fargate. It grants permissions to provision, configure, and manage the underlying infrastructure required to run applications on ECS.
- ROSAWorkerInstancePolicyReader
Allows Red Hat OpenShift Service on AWS (ROSA) worker nodes in your account read-only access to Amazon EC2 instances and AWS Regions for compute node lifecycle management.
Service-linked roles (9)
- AmazonFISServiceRolePolicyOperator
Policy to enable AWS FIS to manage monitoring and resource selection for experiments.
- AWSECRPullThroughCache_ServiceRolePolicyOperator
Enables access to AWS services and resources used or managed by AWS ECR pull through cache
- AWSElasticBeanstalkServiceRolePolicyOperator
AWS Elastic Beanstalk Service Linked Role policy which grants permissions to create & manage resources (i.e.: AutoScaling, EC2, S3, CloudFormation, ELB, etc.) on your behalf.
- AWSMediaConnectServicePolicyOperator
The default policy that enables access to AWS services and Resources used or managed by MediaConnect.
- AWSMediaLiveAnywhereServiceRolePolicyOperator
Allows MediaLive Anywhere to create and manage AWS resources on your behalf.
- AWSProtonServiceGitSyncServiceRolePolicyOperator
Policy which allows AWS Proton to sync your service, environment and component definitions from your git repository to AWS Proton.
- AWSProtonSyncServiceRolePolicyOperator
Policy which allows AWS Proton to sync your git repository contents to Proton or sync Proton contents to your git repositories.
- ECRReplicationServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by ECR Replication
- ECRTemplateServiceRolePolicyOperator
Allows actions to be performed when using AWS ECR repository creation templates
Also relevant to Containers (34)
- AmazonBraketJobsExecutionPolicyOperator
Grants access to AWS services and resources necessary for executing an Amazon Braket Job including S3, Cloudwatch, IAM and Braket
- AmazonECS_FullAccessAdmin
Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups, and CloudFormation stacks.
- AmazonEKSDashboardConsoleReadOnlyReader
Provides read only access to view the dashboard in the Amazon EKS console. The dashboard aggregates information about multiple clusters and related resources using AWS Organizations.
- AmazonEKSLocalOutpostClusterPolicyOperator
This policy provides permissions to EKS local cluster's control-plane instances running in your account to manage resources on your behalf.
- AmazonEKSServiceRolePolicyOperator
A Service-Linked Role required for Amazon EKS to call AWS services on your behalf.
- AmazonEKSWorkerNodePolicyReader
This policy allows Amazon EKS worker nodes to connect to Amazon EKS Clusters.
- AmazonEMRContainersServiceRolePolicyOperator
Allows access to other AWS service resources that are required to run Amazon EMR
- AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator
GuardDuty malware protection uses the service-linked role (SLR) named AWSServiceRoleForAmazonGuardDutyMalwareProtection. This service-linked role allows GuardDuty malware protection to perform agent-less scans to detect malware. It allows G…
- AmazonGuardDutyServiceRolePolicyOperator
Enable access to AWS Resources used or managed by Amazon Guard Duty
- AmazonInspector2ServiceRolePolicyOperator
Grants Amazon Inspector access to AWS services needed to perform security assessments
- AmazonPrometheusScraperServiceRolePolicyOperator
Provides access to AWS Resources managed or used by Amazon Managed Service for Prometheus Collector
- AmazonSageMakerHyperPodInferenceAccessOperator
This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…
- AmazonSageMakerHyperPodObservabilityAdminAccessOperator
This policy provides administrative privileges required for setting up SageMaker HyperPod observability. It enables access to Amazon Managed Prometheus, Amazon Managed Grafana and EKS Addons. The policy also includes broad access to Grafana…
- AmazonSageMakerHyperPodServiceRolePolicyOperator
This policy grants permissions to Amazon SageMaker HyperPod to related AWS services such as Amazon EKS, Amazon CloudWatch etc.
- AWSApplicationAutoscalingECSServicePolicyOperator
Policy granting permissions to Application Auto Scaling to access EC2 Container Service and CloudWatch.
- AWSBackupServiceLinkedRolePolicyForBackupOperator
Provides AWS Backup permission to create backups on your behalf across AWS services
- AWSBackupServiceRolePolicyForBackupOperator
Provides AWS Backup permission to create backups on your behalf across AWS services
- AWSBackupServiceRolePolicyForRestoresOperator
Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…
- AWSBatchFullAccessAdmin
Provides full access for AWS Batch resources.
- AWSBatchServiceRoleOperator
Policy for AWS Batch service role which allows access to related services including EC2, Autoscaling, EC2 Container service and Cloudwatch Logs.
- AWSCodeDeployRoleForECSOperator
Provides CodeDeploy service wide access to perform an ECS blue/green deployment on your behalf. Grants full access to support services, such as full access to read all S3 objects, invoke all Lambda functions, publish to all SNS topics withi…
- AWSCodeDeployRoleForECSLimitedOperator
Provides CodeDeploy service limited access to perform an ECS blue/green deployment on your behalf.
- AWSContinuumCollectorServiceRolePolicyOperator
Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.
- AWSFaultInjectionSimulatorEKSAccessOperator
This policy grants the Fault Injection Simulator Service permission in EKS and other required services to perform FIS actions.
- AWSManagedServicesDeploymentToolkitPolicyOperator
Allows AWS Managed Services to manage deployment toolkit on your behalf.
- AWSNetworkFirewallIGWServiceRolePolicyOperator
Allows AWS Network Firewall to manage resources required for IGW Firewall on your behalf. Example of such resources include elastic IP addresses for network address translation.
- AWSNetworkFirewallServiceRolePolicyOperator
Allow AWSNetworkFirewall to create and manage necessary resources for your Firewalls.
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicyOperator
Provides access to manage AWS Config recorder resource and telemetry settings on AWS resources including logs, metrics.
- AWSProtonCodeBuildProvisioningBasicAccessOperator
Permissions CodeBuild needs to run a build for AWS Proton CodeBuild Provisioning.
- BatchServiceRolePolicyOperator
Provides access for the AWS Batch service to manage the required resources, including Amazon EC2 and Amazon ECS resources.
- CloudWatchApplicationInsightsFullAccessAdmin
Provides full access to CloudWatch Application Insights and required dependencies.
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
Cloudwatch Application Insights Service Linked Role Policy
- CloudWatchAutomaticDashboardsAccessReader
Provides access to the non-CloudWatch APIs used to display CloudWatch Automatic Dashboards, including the contents of objects such as Lambda functions
- EC2ImageBuilderLifecycleExecutionPolicyOperator
The EC2ImageBuilderLifecycleExecutionPolicy policy grants permissions for Image Builder to perform actions such as deprecate or delete Image Builder image resources and their underlying resources (AMIs, snapshots) to support automated rules…