Management & Governance: Operator policies

Provides ReadOnly permissions required by the Amazon AI Operations Assistant to do analysis on customer AWS resources during investigations.

Grants access to the Amazon AI Operations APIs for creating, updating, and deleting investigations, investigation events, and investigation resources. It also includes ReadOnly access to all AI Operations APIs and to use identity-aware sess…

Grants permissions to ARC Region switch for plan execution and plan evaluation.

Amazon DataZone is a data management service that enables you to catalog, discover, govern, share, and analyze your data. With Amazon DataZone, you can share and access your data across accounts and supported regions. Amazon DataZone simpli…

This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userg…

These permissions enable Amazon ECS to automatically provision and manage the infrastructure components required for Express Gateway Services, including load balancing, security groups, SSL certificates, and auto scaling configurations.

Provides ECS access to create and manage EC2 managed resources

Allows Amazon EKS Local to call AWS services on your behalf.

This policy is used for the Amazon EMR Service Role and should NOT be used for any other IAM users or roles in your account. The policy grants permissions to create and manage resources associated with EMR and related services necessary for…

Enable access to AWS Resources used or managed by Amazon Guard Duty

Grants Amazon Inspector access to AWS services needed to perform security assessments for AMI

Grants Amazon Inspector access to AWS services needed to perform security assessments

This policy grants permissions commonly needed to use Amazon SageMaker Cluster.

This is a new managed policy for Model Registry in Sagemaker. This policy is a standalone policy that can be attached to the user role to access Model Registry related functionalities in Sagemaker.

Provide permission for Diagnosing issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a cross-account cross-region setup by triggering child automation…

Provide permission for Diagnosing issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by diagnosing SSM service health ac…

Provide permission for Remediating issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a cross-account cross-region setup by triggering child automatio…

Provides permissions for Remediating issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a target account/region setup by remediating SSM services heal…

Provides required permissions to manage an account for AWS applications.

Provides permissions to automate VMware to AWS network infrastructure migration through CloudFormation

This policy grants full permissions to list, download, accept, and terminate AWS Artifact agreements. It also includes permissions to list and enable AWS service access in the Organization service, as well as describe the organization detai…

Provides full access to the Artifact Compliance Inquiry.

This policy grants permissions for users to create controls and frameworks that define their expectations for AWS Backup resources and activities, and to audit AWS Backup resources and activities against their defined controls and framework…

Provides AWS Backup permission to create backups on your behalf across AWS services

Provides AWS Backup permission to create backups on your behalf across AWS services

Provides AWS Billing Conductor access to manage billing groups and related resources

This policy gives permissions to control AWS resources. For example, to start and stop EC2 or RDS instances by executing AWS Systems Manager (SSM) scripts.

Grants the AWS Budgets service permissions to describe, stop, and terminate resources in a member account to enforce spend limit actions.

Provides the ability to be invited into AWS Cloud9 shared development environments.

Service Linked Role Policy for AWS Cloud9

Provides permission to create AWS Cloud9 development environments and to manage owned environments.

Provides CloudWatch Omni access to manage AWS Config recorder resources, telemetry configurations, and supporting IAM roles for organization enablement.

Allows AWS CodeStar Notifications to access Amazon CloudWatch Events on your behalf

Grants permissions to to describe the organization of the account, create S3 buckets for the MAP program and apply tags to it, create a Cost and Usage Report, and describe Cost and Usage Report definitions.

Policy for the Directory Service Service Linked Role

EC2 SQL High Availability service permissions to detect standby/passive instances

Grants Amazon EC2 and AWS SSM permissions to restore SQL Server database from application consistent snapshots created by AWS VSS.

This policy grants the Fault Injection Simulator Service permission in EC2 and other required services to perform FIS actions.

This policy grants the Fault Injection Simulator Service permission in ECS and other required services to perform FIS actions.

This policy grants the Fault Injection Simulator Service permission in EKS and other required services to perform FIS actions.

This policy grants the Fault Injection Simulator Service permission in RDS and other required services to perform FIS actions.

Provides AWS FinOps Agent access to billing, cost management, usage, optimization, and resource configuration capabilities to generate cost and savings insights, and allows it to manage its own Amazon EventBridge rules for configured workfl…

Managed policy for AWS For Wordpress Plugin

Allows VPC IP Address Manager to access VPC resources and integrate with AWS Organizations on your behalf.

Provides cross account access to Glue resources via Lake Formation. Also grants read access to other required services such as organizations and resource access manager

Allows AWS License Manager User Subscriptions Service to manage resources on your behalf.

Grants AWS permission to manage organization control policies for AWS managed accounts

AWS Managed Services - policy to manage detective controls infrastructure

Allows AWS Managed Services to manage deployment toolkit on your behalf.

Provides full access to AWS Marketplace Private Image Build Feature. In addition to create private images, it also provides permissions to add tags to images, launch and terminate ec2 instances.

Provides permissions necessary for Migration Hub Orchestrator to migrate and modernize your on-premises workloads

Use in the IAM service role passed to the SSM Automation document AWSRefactorSpaces-CreateResources to grant permissions required to run the automation. The policy grants read/write access to EC2 tags in order to track automation progress. …

Allows AWS Network Firewall to manage resources required for IGW Firewall on your behalf. Example of such resources include elastic IP addresses for network address translation.

Allow AWSNetworkFirewall to create and manage necessary resources for your Firewalls.

Provides access to manage AWS Config recorder resource and telemetry settings on AWS resources including logs, metrics.

QuickSetup creates IAM roles which enable it to configure the Systems Manager Distributor feature on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

This policy grants permissions that allow principals to run the AWSQuickSetupType-EnableDHMC Automation runbook, which enables Default Host Management Configuration.

This policy grants administrative permissions that allow Systems Manager to create a default IAM instance profile for the Quick Setup capability and attach it to Amazon EC2 instances that don't already have an instance. profile attached.

This policy provides permissions to enable just-in-time node access for Systems Manager.

Provides permissions that allow Quick Setup to create resources associated with a patch policy configuration.

QuickSetup creates IAM roles which enable it to configure the Systems Manager Patch Manager feature on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

Quick Setup creates IAM roles which enable it to configure the Host Manager Quick Setup type on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

The managed policy AWSQuickSetupStartStopInstancesExecutionPolicy provides permissions for Quick Setup to start and stop Amazon EC2 instances on a schedule. This policy is used with the Quick Setup scheduler configuration type.

Allows VPC Reachability Analyzer to access AWS resources and integrate with AWS Organizations on your behalf.

This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d…

Policy for AWS Resilience Hub service role which allows access to other AWS services in order to execute assessment.

Allows AWS Resilience Hub to access resources in your account for resilience discovery, assessment, and management. This policy grants wildcarded read-only permissions that may include sensitive information in the output.

Allow SDMP to create and manage resources on behalf of the customer.

This policy allows Security Hub to manage AWS Config rules and Security Hub resources in your organization and on your behalf.

Provides access to AWS Resources managed or used by Security Incident Response

This Service-Linked Role provides AWS Transform with the ability to provide usage information.

Allows EC2ImageBuilder to call AWS services on your behalf.

Provides permissions to describe and update Private Marketplace resources and describe AWS Organizations

Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.

Provides read only access to AWS SSO configurations.

Grants AWS SSO permissions to manage AWS resources, including IAM roles, policies and SAML IdP on your behalf.

Allows AWS Support to access AWS resources to provide billing, administrative, and support services.

This policy grants AWS Thinkbox's Deadline software full access to multiple AWS services as required for AWS Portal administration. This includes access to create arbitrary tags on several EC2 resource types.

Grants permissions required to create, destroy, and administer AWS Thinkbox's Deadline Resource Tracker.

Enables the AWS Transform service to deploy transformed .NET applications by creating and managing AWS resources. This policy grants permissions to provision infrastructure, manage compute resources, and configure deployment settings across…

Enables the AWS Transform to deploy applications to Amazon Elastic Container Service (ECS) with Fargate. It grants permissions to provision, configure, and manage the underlying infrastructure required to run applications on ECS.

Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration

Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.

Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

Provides permissions to control service managed resources and call APIs necessary for log field enrichment on behalf of customers.

Provides administrative access for ARC zonal shift practice runs, and access to CloudWatch alarm statuses to monitor practice runs.

Service Role for CloudFormation StackSets (Organization Member Account)

This service linked role allows CloudTrail to get and add resource tags to the resource owner's CloudTrail events.

Full permissions required to use AmazonCloudWatchAgent.

Policy grants permission to CloudWatch Application Signals to collect monitoring and tagging data from other relevant AWS services.

You can't attach CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor\_Topology, which generates topology snapshots of resourc…

Provides permissions required by CloudWatch Omni to discover and read AWS resource topology

This managed policy provides admin access to Cost Optimization Hub.

Permissions required by DynamoDB for cross-region data replication

This policy grants full access to EC2 Fast Launch actions

Grants permissions that allow EC2 Image Builder to call AWS services on your behalf

Provides permissions required by the AWS FinOps Agent to perform cost analysis and spot cost saving opportunity on customer AWS resources.

Access policy to allow FM service linked role to perform FM-related actions on FM-managed resources within a customer AWS Organization account.

Permissions required by Keyspaces for cross-region data replication

Provides permissions for the AWS Shield network security director service linked role to assess specified environments.

Access policy to allow NetworkSecurityManager service linked role to perform NetworkSecurityManager-related actions on NetworkSecurityManager-managed resources within a customer AWS account.

Provides read-only access to AWS services and resources.

Allows the OpenShift Ingress Operator to provision and manage load balancers and domain name system (DNS) configurations for Red Hat OpenShift Service on AWS (ROSA) clusters. The policy allows read access to tag values, which the operator f…

Allows the Red Hat OpenShift Service on AWS (ROSA) installer to configure Route53 records. Intended to be used on a shared VPC.

Service Linked Role Policy for Route 53 Recovery Readiness

Service role for domain level actions in the portal that are performed by Amazon SageMaker Studio.

Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.

This policy creates a service-linked role that allows AWS WAF to write logs to Amazon Kinesis Data Firehose.