Skip to main content
IAM Policy Map
IAM Policy Map
Job functions: Switch between the hub and domains
MapList

Can change permissions or pass roles: 4 of 15 policies: 0 unrestricted, 4 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 7 of 15 policies: 3 write, 4 read only, 0 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Job functions policies

AWS job-function policies (ARN path /job-function/). Assigned by rule.

15 AWS managed policies. 15 have reviewed guidance; the rest have authoritative permission data pending editorial review.

Loading map…

Loading map

User access (7)

  • AWSManagementConsoleAdministratorAccessAdmin

    Provides full access to configure and customize the AWS Management Console

  • BillingAdmin

    Grants permissions for billing and cost management. This includes viewing account usage and viewing and modifying budgets and payment methods.

  • DatabaseAdministratorHigh privilegeAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS database services.

  • DataScientistHigh privilegeAdmin

    Grants permissions to AWS data analytics services.

  • NetworkAdministratorAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS network resources.

  • SupportUserAdmin

    This policy grants permissions to troubleshoot and resolve issues in an AWS account. This policy also enables the user to contact AWS support to create and manage cases.

  • SystemAdministratorHigh privilegeAdmin

    Grants full access permissions necessary for resources required for application and development operations.

Operator and limited (8)

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.