Skip to main content
IAM Policy Map
IAM Policy Map
IoT & Edge: Switch between the hub and domains
MapList

Can change permissions or pass roles: 8 of 45 policies: 0 unrestricted, 8 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 15 of 45 policies: 8 write, 7 read only, 0 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

IoT & Edge policies

Connected devices, edge runtimes, robotics and satellite ground stations.

45 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review. 5 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (19)

IoT (4)

IoT Analytics (3)

IoT SiteWise (3)

  • AWSIoTSiteWiseConsoleFullAccessAdmin

    Provides full access to manage AWS IoT SiteWise using the AWS Management Console. Note this policy also grants access to create and list data stores used with AWS IoT SiteWise (e.g. AWS IoT Analytics), access to list and view AWS IoT Greeng…

  • AWSIoTSiteWiseFullAccessAdmin

    Provides full access to IoT SiteWise.

  • AWSIoTSiteWiseReadOnlyAccessReader

    Provides read only access to IoT SiteWise.

RoboMaker (3)

IoT Greengrass (2)

  • AWSGreengrassFullAccessAdmin

    This policy gives full access to the AWS Greengrass configuration, management and deployment actions

  • AWSGreengrassReadOnlyAccessReader

    This policy gives read only access to the AWS Greengrass configuration, management and deployment actions

Other services (4)

Operator and limited (8)

Service roles (13)

IoT (6)

IoT Greengrass (2)

  • AWSDeepLensServiceRolePolicyOperator

    Grants AWS DeepLens access to AWS services, resources and roles needed by DeepLens and its dependencies including IoT, S3, GreenGrass and AWS Lambda.

  • AWSGreengrassResourceAccessRolePolicyAdmin

    Policy for AWS Greengrass service role which allows access to related services including AWS Lambda and AWS IoT thing shadows.

Panorama (2)

  • AWSPanoramaGreengrassGroupRolePolicyAdmin

    Allows an AWS Lambda function on an AWS Panorama Appliance to manage resources in Panorama, upload logs and metrics to Amazon CloudWatch, and to manage objects in buckets created for use with Panorama.

  • AWSPanoramaServiceRolePolicyOperator

    Allows AWS Panorama to manage resources in Amazon S3, AWS IoT, AWS IoT GreenGrass, AWS Lambda, Amazon SageMaker, and Amazon CloudWatch Logs, and to pass service roles to AWS IoT, AWS IoT GreenGrass, and Amazon SageMaker.

Other services (3)

Service-linked roles (5)

  • AWSIoTSiteWiseMonitorServiceRolePolicyOperator

    This role grants AWS IoT SiteWise monitor permissions to access your AWS IoT SiteWise assets & asset properties, and create AWS IoT Sitewise projects, dashboards & access policies through AWS IoT SiteWise portals.

  • AWSIoTTwinMakerServiceRolePolicyOperator

    Allows AWS IoT TwinMaker to call other AWS services and to sync their resources on your behalf.

  • AWSPanoramaServiceLinkedRolePolicyOperator

    Allows AWS Panorama to manage resources in AWS IoT, AWS Secrets Manager and AWS Panorama.

  • AWSRoboMakerServicePolicyOperator

    RoboMaker service policy

  • AWSServiceRoleForIoTSiteWiseOperator

    Allows AWS IoT SiteWise to provision and manage gateways as well as query data. The policy includes required AWS Greengrass permissions for deploying to groups, AWS Lambda permissions for creating and updating service-prefixed functions, an…

Also relevant to IoT & Edge (6)
IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.