Skip to main content
IAM Policy Map
IAM Policy Map
Databases: Switch between the hub and domains
MapList

Can change permissions or pass roles: 9 of 53 policies: 0 unrestricted, 9 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 31 of 53 policies: 8 write, 19 read only, 4 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Databases policies

Relational, NoSQL, in-memory and graph databases.

53 AWS managed policies. 11 have reviewed guidance; the rest have authoritative permission data pending editorial review. 6 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (28)

RDS (5)

  • AmazonDocDBConsoleFullAccessAdmin

    Provides full access to manage Amazon DocumentDB with MongoDB compatibility using the AWS Management Console. Note this policy also grants full access to publish on all SNS topics within the account, permissions to create and edit Amazon EC…

  • AmazonDocDBReadOnlyAccessReader

    Provides read-only access to Amazon DocumentDB with MongoDB compatibility. Note that this policy also grants access to Amazon RDS and Amazon Neptune resources.

  • AmazonRDSFullAccessAdmin

    Provides full access to Amazon RDS via the AWS Management Console.

  • AmazonRDSPerformanceInsightsReadOnlyReader

    Read-Only policy for RDS Performance Insights

  • AmazonRDSReadOnlyAccessReader

    Provides read only access to Amazon RDS via the AWS Management Console.

Keyspaces (4)

Aurora DSQL (3)

Neptune (3)

  • NeptuneFullAccessAdmin

    Provides full access to Amazon Neptune. Note this policy also grants full access to publish on all SNS topics within the account and full access to Amazon RDS. For more information, see https://aws.amazon.com/neptune/faqs/.

  • NeptuneGraphReadOnlyAccessReader

    Provides read only access to all Amazon Neptune Analytics resources along with read only permissions for dependent services.

  • NeptuneReadOnlyAccessReader

    Provides read only access to Amazon Neptune. Note that this policy also grants access to Amazon RDS resources. For more information, see https://aws.amazon.com/neptune/faqs/.

QLDB (3)

DocumentDB Elastic Clusters (2)

  • AmazonDocDBElasticFullAccessAdmin

    Provides full access to Amazon DocumentDB Elastic Clusters and other required permissions for its dependencies including EC2, KMS, SecretsManager, CloudWatch and IAM.

  • AmazonDocDBElasticReadOnlyAccessReader

    Provides read-only access to Amazon DocDB-Elastic and CloudWatch metrics.

ElastiCache (2)

MemoryDB (2)

Oracle Database@AWS (2)

Other services (2)

  • AmazonDynamoDBReadOnlyAccessReader

    Provides read only access to Amazon DynamoDB via the AWS Management Console.

  • AmazonRedshiftQueryEditorV2FullAccessAdmin

    Grants full access to the Amazon Redshift Query Editor V2 operations and resources. This policy also grants access to other required services. This includes permissions to list the Amazon Redshift clusters, read keys and aliases in AWS KMS …

Operator and limited (11)

  • AmazonDocDBFullAccessOperator

    Provides full access to Amazon DocumentDB with MongoDB compatibility. Note this policy also grants full access to publish on all SNS topics within the account and full access to Amazon RDS and Amazon Neptune.

  • AmazonRDSPerformanceInsightsFullAccessOperator

    Provides full access to RDS Performance Insights via the AWS Management Console

  • AmazonRedshiftQueryEditorV2NoSharingOperator

    Grants the ability to work with Amazon Redshift Query Editor V2 without sharing resources. The granted principal can only read, update and delete its own resources but cannot share them. This policy also grants access to other required serv…

  • AmazonRedshiftQueryEditorV2ReadSharingOperator

    Grants the ability to work with Amazon Redshift Query Editor V2 with limited sharing of resources. The granted principal can read, write and share its own resources. The granted principal can read the resources shared with its team but cann…

  • AmazonRedshiftQueryEditorV2ReadWriteSharingOperator

    Grants the ability to work with Amazon Redshift Query Editor V2 with sharing of resources. The granted principal can read, write and share its own resources. The granted principal can read and update the resources shared with its team. This…

  • AmazonTimestreamInfluxDBFullAccessOperator

    Provides full administrative access to create, update, delete and list Amazon Timestream InfluxDB instances and create and list parameter groups. Please refer to documentation for additional permissions needed.

  • AmazonTimestreamInfluxDBFullAccessWithoutMarketplaceAccessOperator

    Provides administrative access to manage Amazon Timestream InfluxDB instances and parameter groups except marketplace operations.

  • AmazonTimestreamReadOnlyAccessOperator

    Provides read only access to Amazon Timestream. Policy also provides permission to cancel any running query. If using Customer managed CMK, please refer to documentation for additional permissions needed.

  • AWSLambdaInvocation-DynamoDBOperator

    Provides read access to DynamoDB Streams.

  • AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator

    Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.

  • NeptuneConsoleFullAccessOperator

    Provides full access to manage Amazon Neptune using the AWS Management Console. Note this policy also grants full access to publish on all SNS topics within the account, permissions to create and edit Amazon EC2 instances and VPC configurat…

Service roles (8)

  • AWSBackupServiceRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForRestoresOperator

    Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…

  • AWSElasticBeanstalkRoleRDSOperator

    (Elastic Beanstalk operations role) Allows an environment to integrate an Amazon RDS instance.

  • AWSElasticBeanstalkRoleWorkerTierOperator

    (Elastic Beanstalk operations role) Allows a worker environment tier to create an Amazon DynamoDB table and an Amazon SQS queue.

  • AWSFaultInjectionSimulatorRDSAccessOperator

    This policy grants the Fault Injection Simulator Service permission in RDS and other required services to perform FIS actions.

  • AWSLambdaDynamoDBExecutionRoleOperator

    Provides list and read access to DynamoDB streams and write permissions to CloudWatch logs.

  • AWSQuickSightDescribeRDSReader

    Allow QuickSight to describe the RDS resources

  • AWSQuickSightTimestreamPolicyOperator

    AWS QuickSight access to AWS Timestream APIs. Customers can attach this policy to AWS QuickSight role to allow retrieval of data and metadata.

Service-linked roles (6)

Also relevant to Databases (44)
  • AmazonDataZoneEnvironmentRolePermissionsBoundaryAdmin

    Amazon DataZone creates IAM roles for Environments to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDevOpsGuruServiceRolePolicyOperator

    A service-linked role required for Amazon DevOpsGuru to access your resources.

  • AmazonDynamoDBFullAccessHigh privilegeAdmin

    Provides full access to Amazon DynamoDB via the AWS Management Console.

  • AmazonDynamoDBFullAccess_v2High privilegeAdmin

    Provides full access to Amazon DynamoDB

  • AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…

  • AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin

    Default policy for the Amazon EC2 Role for Data Pipeline service role.

  • AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin

    Default policy for the Amazon Elastic MapReduce for EC2 service role.

  • AmazonMCSReadOnlyAccessReader

    Provide read only access to Amazon Managed Apache Cassandra Service

  • AmazonODBAutonomousDatabaseAdminOperator

    Provides administrative access to manage Autonomous Database resources in Oracle Database@AWS.

  • AmazonODBAutonomousVmClusterAdminOperator

    Provides administrative access to manage Autonomous VM cluster resources in Oracle Database@AWS

  • AmazonODBExadataInfrastructureAdminOperator

    Provides administrative access to manage Exadata Infrastructure resources in Oracle Database@AWS

  • AmazonODBExadataVmClusterAdminOperator

    Provides administrative access to manage Exadata VM cluster resources in Oracle Database@AWS.

  • AmazonODBExascaleStorageVaultAdminOperator

    Provides administrative access to manage Exascale storage vault resources in Oracle Database@AWS.

  • AmazonODBExascaleVmClusterAdminOperator

    Provides administrative access to manage Exascale VM cluster resources in Oracle Database@AWS.

  • AmazonODBNetworkAdminOperator

    Provides administrative access to networking resources for Oracle Database@AWS

  • AmazonRDSDataFullAccessHigh privilegeAdmin

    Allows full access to use the RDS data APIs, secret store APIs for RDS database credentials, and DB console query management APIs to execute SQL statements on Aurora Serverless clusters in the AWS account.

  • AmazonTimestreamConsoleFullAccessHigh privilegeAdmin

    Provides full access to manage Amazon Timestream using the AWS Management Console. Note that this policy also grants permissions for certain KMS operations, and operations to manage your saved queries. If using Customer managed CMK, please …

  • AmazonTimestreamFullAccessHigh privilegeAdmin

    Provides full access to Amazon Timestream. Note that this policy also grants certain KMS operation access. If using Customer managed CMK, please refer to documentation for additional permissions needed.

  • AmplifyBackendDeployFullAccessOperator

    Provides Amplify full access permissions to deploy Amplify backend resources (AWS AppSync, Amazon Cognito, Amazon S3 and other related services) via the AWS Cloud Development Kit (AWS CDK)

  • AWSApplicationAutoscalingCassandraTablePolicyOperator

    Policy granting permissions to Application Auto Scaling to access Cassandra and CloudWatch.

  • AWSApplicationAutoscalingDynamoDBTablePolicyOperator

    Policy granting permissions to Application Auto Scaling to access DynamoDB and CloudWatch.

  • AWSBackupOperatorAccessOperator

    This policy grants users permissions to assign AWS resources to backup plans, create on-demand backups, and restore backups. This policy does not allow the user to create or edit backup plans or to delete scheduled backups after they are cr…

  • AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSMOperator

    This policy gives permissions to control AWS resources. For example, to start and stop EC2 or RDS instances by executing AWS Systems Manager (SSM) scripts.

  • AWSBudgetsSpendLimitMemberRolePolicyOperator

    Grants the AWS Budgets service permissions to describe, stop, and terminate resources in a member account to enforce spend limit actions.

  • AWSIoTRuleActionsHigh privilegeOperator

    Allows access to all AWS services supported in AWS IoT Rule Actions

  • AWSLambdaFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.

  • AWSResilienceHubAsssessmentExecutionPolicyOperator

    Policy for AWS Resilience Hub service role which allows access to other AWS services in order to execute assessment.

  • AWSResilienceHubV2AssessmentExecutionPolicyOperator

    Allows AWS Resilience Hub to access resources in your account for resilience discovery, assessment, and management. This policy grants wildcarded read-only permissions that may include sensitive information in the output.

  • AWSResourceGroupsReadOnlyAccessReader

    This is the read only policy for AWS Resource Groups

  • AWSServiceRolePolicyForBackupRestoreTestingOperator

    This policy contains permissions for testing restores and for cleaning up resources created during tests.

  • AWSThinkboxAWSPortalGatewayPolicyOperator

    This policy grants the AWS Portal Gateway machine the necessary permissions required for normal operation.

  • AWSThinkboxDeadlineResourceTrackerAdminPolicyOperator

    Grants permissions required to create, destroy, and administer AWS Thinkbox's Deadline Resource Tracker.

  • AWSTrustedAdvisorServiceRolePolicyReader

    Access for the AWS Trusted Advisor Service to help reduce cost, increase performance, and improve security of your AWS environment.

  • CloudWatchAutomaticDashboardsAccessReader

    Provides access to the non-CloudWatch APIs used to display CloudWatch Automatic Dashboards, including the contents of objects such as Lambda functions

  • ComputeOptimizerServiceRolePolicyAdmin

    Allows ComputeOptimizer to call AWS services and collect workload details on your behalf.

  • ConsoleFullAccessFromVercelHigh privilegeOperator

    For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to manage all resources for the services that are integrated with the Vercel Marketplace.

  • ConsoleViewOnlyAccessFromVercelReader

    For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to view all resources for the services that are integrated with the Vercel Marketplace.

  • DatabaseAdministratorHigh privilegeAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS database services.

  • DataScientistHigh privilegeAdmin

    Grants permissions to AWS data analytics services.

  • DBModDiscoveryAndAssessmentOperator

    Discovery and Assessment permissions for database connector used in database modernization

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • DynamoDBReplicationServiceRolePolicyHigh privilegeOperator

    Permissions required by DynamoDB for cross-region data replication

  • Route53RecoveryReadinessServiceRolePolicyOperator

    Service Linked Role Policy for Route 53 Recovery Readiness

  • SageMakerStudioBedrockKnowledgeBaseServiceRolePolicyOperator

    Allows Amazon Bedrock Knowledge Bases to access Amazon Bedrock models and data sources in SageMaker Studio.

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.