Management & Governance policies

Provides full access to AWS CloudFormation.

Provides access to AWS CloudFormation via the AWS Management Console.

Provides full access to AWS CodeStar via the AWS Management Console.

Allows CloudFormation to create and manage AWS stacks and resources on your behalf.

Provides full access to service catalog admin capabilities

Provides read-only access to Service Catalog admin capabilities

Provides read-only access to Service Catalog App Registry capabilites

Provides read-only access to Service Catalog end-user capabilities

Allows users to access the Account Activity page.

Provides full access to AWS Account Management.

Provides read-only access to AWS Account Management

This policy grants administrative permissions to access Resource Explorer resources and grants read-only permissions to other AWS services to support this access.

This policy grants administrative permissions to Resource Explorer and grants read-only permissions to other AWS services to support this access. The AWS Organizations administrator needs these permissions to setup and manage multi-account …

This policy grants read-only permissions to search for and view Resource Explorer resources and grants read-only permissions to other AWS services to support this access.

This is the read only policy for AWS Resource Groups

Provides full access to Resource Groups and Tag Editor.

Provides access to use Resource Groups and Tag Editor, but does not allow editing of tags via the Tag Editor.

Provides full access to Amazon SSM.

Provide access to child instances for patch association operation.

Provides read only access to Amazon SSM.

Provides full access to AWS CloudTrail.

Provides read only access to AWS CloudTrail.

Provides full access to Service Quotas

Provides read only access to Service Quotas

Provides full access to supportplans.

Provides read-only access to supportplans.

Provides full access to AWS Well-Architected Tool via the AWS Management Console

Provides read-only access to AWS Well-Architected Tool via the AWS Management Console

Provides read only access to view the dashboard in the Amazon EKS console. The dashboard aggregates information about multiple clusters and related resources using AWS Organizations.

Full access to AWS Launch wizard and other required services.

Provide read only access to Amazon Managed Apache Cassandra Service

Provides access to use AWS Config, including searching by tags on resources, and reading all tags. This does not provide permission to configure AWS Config, which requires administrative privileges.

Provides read-only access to AWS Organizations.

Allows users to access the AWS Support Center.

Provides read-only access to the AWS Support App.

Provides read-only access to AWS Trusted Advisor Priority. This includes permission to view the delegated administrator accounts.

Provides read only access to ComputeOptimizer.

Allows customers to use AWS Systems Manager to automatically manage Amazon EFS utilities (amazon-efs-utils) package on their EC2 instances, and use CloudWatchLog to get EFS file system mount success/failure notifications.

Provides access to view automation executions and send approval decisions to automation waiting for approval

This policy enables AWS Systems Manager functionality on EC2 instances.

The policy for Amazon EC2 Role to enable AWS Systems Manager service core functionality.

This policy grants permissions to start, view, and update incidents with full access to custom timeline events & related items. Assign this policy to users who will create and resolve incidents.

Grants permissions to track which instances are managed by Quick Setup patch policy configurations through automated tagging and inventory collection.

This policy grants administrative permssions that allow Quick Setup to create resources that are used during the Systems Manager onboarding process.

The policy grants administrative permissions that allow Quick Setup to run the a AWS CloudFormation custom resource on lifecycle events during Quick Setup deployment in Systems Manager.

This policy grants permissions that allow principals to run the AWSQuickSetupType-StartSSMAssociations Automation runbook, which starts State Manager Associations.

Provides permissions for AWS Systems Manager Quick Setup to enable and configure AWS Config configuration recording.

This policy grants administrative permissions for enabling Explorer, a capability of AWS Systems Manager. This includes permissions to update related Systems Manager service settings, and to create a service-linked role for Systems Manager.

Provides full access to AWS Systems Manager for SAP service

Provides read only access to AWS Systems Manager for SAP service

The managed policy AWSSystemsManagerJustInTimeAccessTokenPolicy allows Systems Manager to generate access tokens used for just-in-time node access.

The managed policy AWSSystemsManagerJustInTimeAccessTokenSessionPolicy allows Systems Manager to apply scoped down permissions to a just-in-time node access session once it is started.

This policy allows Systems Manager to share a deny-access policy for just-in-time node access from the delegated administrator account to member accounts, and replicate the policy to multiple Regions.

Provides permissions required by the AWS DevOps Agent to read your organization's structure and to manage the CloudFormation StackSets it creates to deploy roles to your member accounts.

Provides Organizations access to manage Delegated administrator for Amazon Detective and scoped access to the console UI dependencies. This also grants permission to create a service-linked role for Detective.

Provide access to enable and manage Amazon DevOps Guru within an organization.

Grants permission to enable and manage AWS Security Hub within an organization. Includes enabling the service across the organization, and determining the delegated administrator account for the service.

Provides permissions for operational accounts to diagnose unmanaged nodes by providing Organisation specific permissions required by SSM automation to pull the list of member accounts within a root of an Organisation to trigger cross-accoun…

Provides permissions for operational accounts to Remediate unmanaged nodes by providing Organisation specific permissions required by SSM automation to pull the list of member accounts within a root of an Organisation to trigger cross-accou…

Amazon EC2 instance permissions to allow EC2 SQL High Availability service to detect instance high availability state through EC2 instance profile.

The AWSQuickSetupSchedulerPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure scheduled operations on …

The AWSQuickSetupCFGCPacksPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to deploy AWS Config conformance packs.

Provides permissions for AWS Systems Manager Quick Setup to deploy multiple configuration types. These configuration types create IAM roles and automations that configure frequently used Amazon Web Services services and features with recomm…

Provides full access to all administrative actions for an AWS Marketplace eProcurement integration.

Provides full access to all administrative actions for an AWS Private Marketplace.

Provides full access to Service Catalog App Registry capabilities

Provides full access to service catalog enduser capabilities

Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using EC2, including uploading source code, retrieving results, monitoring job status, re…

Grants permissions for AWS Transform to set up AWS landing zones including account provisioning, organizational governance, and Control Tower configuration

Provides permissions required by the AWS DevOps Agent to conduct investigations and perform analysis on customer AWS resources.

This policy provides permissions to EKS local cluster's control-plane instances running in your account to manage resources on your behalf.

Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.

Grants Systems Manager activation, session management, and KMS key operations permissions required for the SageMaker Spaces Addon to enable secure remote access to EKS SageMaker Spaces.

This policy provides access to Amazon SSM operations required to use Application Migration Service (MGN) to execute custom post migration command SSM documents. Attach this policy to your IAM users or roles.

This policy is for backup administators who use cross-account backup management to manage backups for the organization.

This policy will be used to attach a role on a InstanceProfile which will allow Cloud9 to use the SSM Session Manager to connect to the instance

This policy allows you to use Amazon SSM and additional services required permissions to run post-launch actions in AWS Elastic Disaster Recovery (AWS DRS). Attach this policy to your IAM roles or users.

Allows full access to the AWS Health Apis and Notifications and the Personal Health Dashboard

Grants the AWS Budgets service permissions to attach and detach Service Control Policies and manage accounts in an AWS Organization to enforce spend limit guardrails on member accounts.

Grants access to essential AWS Management Console features and user experience (UX) capabilities for non-administrative users.

The AWSQuickSetupDevOpsGuruPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure Amazon DevOps Guru. Thi…

This policy grants permissions that allow Systems Manager to run the AWSQuickSetupType-EnableAREX Automation runbook, which enables AWS Resource Explorer for use with Systems Manager.

This policy allows Quick Setup to deploy the configuration type required to set up just-in-time node access.

Grants permissions to manage State Manager associations for automated cleanup operations when Quick Setup configurations are deleted.

This policy is intended to be used by Amazon ECS Tasks created for testing applications in AWS using the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. The policy grants access to download application artifacts from…

This policy allows the re:Post Space service to create, manage, and resolve Support cases that are created through the Space application.

Policy for AWS Resilience Hub service role which allows access to AWS Fault Injection Service in order to start resilience testing.

Provides full access to the AWS Support App and other required services, such as AWS Support and Service Quotas. This policy includes permissions to use the supporting services so that the user can contact AWS Support for support cases, cha…

Provides full access to AWS Trusted Advisor Priority. This policy also enables the user to add Trusted Advisor as a trusted service with AWS Organizations and to specify delegated administrator accounts for Trusted Advisor Priority.

Provides permissions for EC2 Automation service to execute activities defined within Automation documents

Service Role to be used for EC2 Maintenance Window

This policy grants the Fault Injection Simulator Service permission in SSM and other required services to perform FIS actions.

Allows AWS Config to call read-only AWS Organizations APIs

Grants permissions to manage Service Control Policies (SCPs) in AWS Organizations for the AWS Managed Service Access Management service. Includes permissions to list, create, update, and attach SCPs scoped to policies tagged with ManagedBy=…

Allows Amazon CodeCatalyst to create, update, and resolve AWS Support cases on your behalf.

Service role policy used by the AWS CodePipeline within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others…

Provides Amplify full access permissions to deploy Amplify backend resources (AWS AppSync, Amazon Cognito, Amazon S3 and other related services) via the AWS Cloud Development Kit (AWS CDK)

Provides full access to AWS Assurance environments and read-only access to IAM Identity Center user details

Allows AWS Artifact read-only access to operations in AWS Organizations.

Allows an AWS Lambda function to access the AWS Config API and the configuration snapshots that AWS Config delivers periodically to Amazon S3. This access is required by functions that evaluate configuration changes for custom Config rules.

Provides access to AWS Resources managed or used by AWS Control Tower

Provides Amazon Data Lifecycle Manager permission to perform the Systems Manager actions required to run pre and post scripts on all Amazon EC2 instances.

Provides permissions to allow access to the AWS License Manager API actions required to consume upon licenses that the user has entitlements.

AWSSupplyChainFederationAdminAccess provides AWS Supply Chain federated users access to the AWS Supply Chain application, including the required permissions to perform actions within the AWS Supply Chain application. The policy provides adm…

Allows AWS CODA to monitor the deployment of delegations on your behalf.

Allows Amazon's AWS Managed Service's Self Service Reporting feature to read AWS Organization data on your behalf to enable organization level aggregated reporting

Provides access to manage AWS Config Configuration Recorder, manage AWS Config Configuration Aggregator, create AWS Config Service Linked Role for Configuration Recorder functionality, consume recorder configuration data, and read AWS Organ…

Policy for Procurement Insights to obtain Organization Account details

Allows AWS Well-Architected Agent to access organizational structure and delegated administrator information in AWS Organizations on your behalf

Allows Well-Architected to access Organizations on your behalf.

Provides read-only access to the APIs needed to support zone-group access-management for organizations.

AWS Health policy to enable Organizational View feature

Allows split cost allocation data to retrieve AWS Organizations information, if applicable, and collect telemetry data for the split cost allocation data services that the customer has opted in to.

Provides access to AWS Resources managed or used by Amazon SSM

This policy grants Incident Manager permission to manage incident records and related resources on your behalf.

Provides AWS Systems Manager for SAP with the permissions needed to manage and integrate SAP software with AWS.

Policy for Service Linked Role AWSServiceRoleForAmazonSSM\_OpsInsights

Grants AWS Systems Manager (SSM) permission to discover AWS account information.

Provides access to AWS resources managed or used by the AWS Systems Manager change management framework.

Provides access to AWS resources managed or used by the AWS Systems Manager just in time access framework.

IAM role for SSM Explorer to manage OpsData related operations

Provides permissions to check Quick Setup configuration health, ensure consistent use of parameters and provisioned resources, and remediate resources when drift is detected.

Allows CloudWatch Evidently Service to manage associated AWS Resources on behalf of the customer

This policy is used by the service-linked role named AWSServiceRoleForCloudWatchAlarms\_ActionSSMIncidents. CloudWatch uses this service-linked role to perform AWS System Manager Incident Manager actions when a CloudWatch alarm goes in to A…

Provides access to Systems Manager resources used by CloudWatch Alarms

Cloudwatch Application Insights Service Linked Role Policy

You can't attach CloudWatchNetworkFlowMonitorServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor, which publishes network telemetry aggregation results, collecte…

Allows AWS License Manager Linux Subscriptions Service to manage resources on your behalf.

AWS License Manager service master account role policy

AWS License Manager service member account role policy

AWS License Manager service default role policy

Allows Service Catalog AppRegistry to manage Resource Groups on your behalf

A Service Linked Role Policy for AWS ServiceCatalog to sync with AWS Organizations organization structure

A Service Linked Role for AWS ServiceCatalog to sync Provisioning Artifacts from source repositories

Allows WellArchitected to access AWS services and resources that relate to WellArchitected resources on behalf of customers.

Allows AWS Config to remediate noncompliant resources on your behalf.

Provides permissions for AWS Config to inventory and evaluate compliance of third-party cloud resources.

Policy needed for AWSConfig to create conformance packs

Grants account access manager permissions to manage AWS account access

Allows Config to call AWS services and deploy config resources across organization

Allows AWS Data Exchange to access AWS services and Resources used or managed by AWS Data Exchange for license management.

Allows AWS Data Exchange to read data about your AWS Organization to determine eligibility for AWS Data Exchange data grants license distribution.

This policy allows Amazon EKS to manage AWS resources for EKS connector

This policy enables the Amazon EKS Dashboard to access and display organization-wide information. The policy allows the EKS Dashboard service to gather information about your AWS Organizations structure and accounts.

Grants the AWS User Notifications service permissions to manage account contact associations.

Allows AWS User Notifications to call AWS services on your behalf.

Allows Amazon Detective to make service calls on your behalf

A service-linked role required for Amazon DevOpsGuru to access your resources.

Grants permissions for Amazon Inspector to perform actions on your behalf for multi-cloud resource scanning.

Allows AWS Agent Registry to access AWS service resources on your behalf

Allows AWS Artifact to gather information about an organization via AWS Organizations service.

Allows AWS Control Tower to call AWS services that provide automated account configuration and centralized governance on your behalf.

Allows EC2 Capacity Manager to manage capacity resources and integrate with AWS Organizations on your behalf.

AWS Elastic Beanstalk Service Role policy that grants limited permissions to update your resources on your behalf for maintenance purposes.

Enables access to AWS services and Resources used or managed by AWS Marketplace for license management.

Allows AWS Proton to manage Proton resource provisioning using CodeBuild and other AWS services on your behalf.

Allows AWS Resilience Hub to access resources in your account for resilience discovery, assessment, and management.

Policy containing Read-only AWS Resource Access Manager access to customers' Organizations structure. It also contains IAM permissions to self-delete the role.

A service-linked role required for AWS Security Hub to access your resources.

Provides AWS Backup permissions to create compliance reports on your behalf

Allows AWS Support Plans to read and update AWS resources used to manage your account's Support Plan on your behalf.

Service Policy for Trusted Advisor Multi-account Reporting

Service Role for CloudFormation StackSets (Organization Master Account)

Permission policy for CloudTrail ServiceLinkedRole

Allows ComputeOptimizer to call AWS services and collect workload details on your behalf.

Allows Cost Optimization Hub to retrieve organization information and collect optimization-related data and metadata.

Permissions required by DynamoDB to manage global table replica settings

Allows AWS Resource Groups to query the AWS services that own your resources to keep the group up-to-date

Enables access to AWS services and Resources used or managed by S3 Storage Lens

This policy grants permissions to operate the Amazon Security Lake service on your behalf

Allows Service Quotas to create support cases on your behalf

Provides read-only access to the AWS Resource Groups Tagging API for the Tags Health service-linked role.