Skip to main content
IAM Policy Map
IAM Policy Map
Developer Tools: Switch between the hub and domains
MapList

Can change permissions or pass roles: 2 of 42 policies: 0 unrestricted, 2 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 13 of 42 policies: 2 write, 11 read only, 0 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Developer Tools policies

Source control, build, deploy, test and developer assistants.

42 AWS managed policies. 1 have reviewed guidance; the rest have authoritative permission data pending editorial review. 4 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (23)

CodeCommit (3)

CodeDeploy (3)

CodeGuru (3)

CodeArtifact (2)

CodeBuild (2)

  • AWSCodeBuildAdminAccessAdmin

    Provides full access to AWS CodeBuild via the AWS Management Console. Also attach AmazonS3ReadOnlyAccess to provide access to download build artifacts, and attach IAMFullAccess to create and manage the service role for CodeBuild.

  • AWSCodeBuildReadOnlyAccessReader

    Provides read only access to AWS CodeBuild via the AWS Management Console. Also attach AmazonS3ReadOnlyAccess to provide access to download build artifacts.

CodeCatalyst (2)

CodePipeline (2)

DevOps Agent (2)

Other services (4)

Operator and limited (12)

Service roles (3)

  • AIDevOpsChannelAccessPolicyOperator

    Provide access to chat and manage investigations through AWS DevOps Agent for your AgentSpaces

  • AIDevOpsConstellationAccessPolicyOperator

    Provides permissions required by the AWS DevOps Agent to coordinate with AgentSpaces connected through Agent Space Constellation.

  • AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicyOperator

    Service role policy used by the AWS CloudWatch Events within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline and others.

Service-linked roles (4)

Also relevant to Developer Tools (15)
  • AdministratorAccess-AmplifyHigh privilegeAdmin

    Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications.

  • AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyOperator

    Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…

  • AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicyOperator

    Service role policy used by the AWS CodePipeline within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others…

  • AWSCodeStarFullAccessReader

    Provides full access to AWS CodeStar via the AWS Management Console.

  • AWSCodeStarServiceRoleAdmin

    DO NOT USE - AWS CodeStar Service Role Policy which grants administrative privileges in order for CodeStar to manage IAM and other service resources on behalf of the customer.

  • AWSManagementConsoleAdministratorAccessAdmin

    Provides full access to configure and customize the AWS Management Console

  • AWSManagementConsoleBasicUserAccessOperator

    Grants access to essential AWS Management Console features and user experience (UX) capabilities for non-administrative users.

  • AWSMobileHub_FullAccessOperator

    This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

  • AWSProtonCodeBuildProvisioningServiceRolePolicyOperator

    Allows AWS Proton to manage Proton resource provisioning using CodeBuild and other AWS services on your behalf.

  • AWSProtonDeveloperAccessOperator

    Provides access to the AWS Proton APIs and Management Console, but does not allow administration of Proton templates or environments.

  • AWSProtonReadOnlyAccessReader

    Provides read only access to the AWS Proton APIs and Management Console.

  • AWSProtonSyncServiceRolePolicyOperator

    Policy which allows AWS Proton to sync your git repository contents to Proton or sync Proton contents to your git repositories.

  • AWSServiceCatalogSyncServiceRolePolicyOperator

    A Service Linked Role for AWS ServiceCatalog to sync Provisioning Artifacts from source repositories

  • AWSServiceRoleForCodeWhispererPolicyOperator

    This role grants permissions to CodeWhisperer to access data in your account to calculate billing, provides access to create and access security reports in Amazon CodeGuru, and emit data to CloudWatch.

  • SageMakerStudioProjectUserRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions.

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.