Management & Governance: Reader policies
Account structure, configuration, provisioning, auditing and operations tooling.
47 AWS managed policies. 6 have reviewed guidance; the rest have authoritative permission data pending editorial review. 22 are service-linked role policies, shown with permission data only.
User access (23)
CloudFormation (2)
- AWSCloudFormationReadOnlyAccessReader
Provides access to AWS CloudFormation via the AWS Management Console.
- AWSCodeStarFullAccessReader
Provides full access to AWS CodeStar via the AWS Management Console.
Service Catalog (3)
- AWSServiceCatalogAdminReadOnlyAccessReader
Provides read-only access to Service Catalog admin capabilities
- AWSServiceCatalogAppRegistryReadOnlyAccessReader
Provides read-only access to Service Catalog App Registry capabilites
- AWSServiceCatalogEndUserReadOnlyAccessReader
Provides read-only access to Service Catalog end-user capabilities
Account (2)
- AWSAccountActivityAccessReader
Allows users to access the Account Activity page.
- AWSAccountManagementReadOnlyAccessReader
Provides read-only access to AWS Account Management
Resource Explorer (1)
- AWSResourceExplorerReadOnlyAccessReader
This policy grants read-only permissions to search for and view Resource Explorer resources and grants read-only permissions to other AWS services to support this access.
Resource Groups (2)
- AWSResourceGroupsReadOnlyAccessReader
This is the read only policy for AWS Resource Groups
- ResourceGroupsandTagEditorReadOnlyAccessReader
Provides access to use Resource Groups and Tag Editor, but does not allow editing of tags via the Tag Editor.
Systems Manager (2)
- AmazonSSMPatchAssociationReader
Provide access to child instances for patch association operation.
- AmazonSSMReadOnlyAccessReader
Provides read only access to Amazon SSM.
CloudTrail (1)
- AWSCloudTrail_ReadOnlyAccessReader
Provides read only access to AWS CloudTrail.
Service Quotas (1)
- ServiceQuotasReadOnlyAccessReader
Provides read only access to Service Quotas
Support Plans (1)
- AWSSupportPlansReadOnlyAccessReader
Provides read-only access to supportplans.
Well-Architected Tool (1)
- WellArchitectedConsoleReadOnlyAccessReader
Provides read-only access to AWS Well-Architected Tool via the AWS Management Console
Other services (7)
- AmazonEKSDashboardConsoleReadOnlyReader
Provides read only access to view the dashboard in the Amazon EKS console. The dashboard aggregates information about multiple clusters and related resources using AWS Organizations.
- AmazonMCSReadOnlyAccessReader
Provide read only access to Amazon Managed Apache Cassandra Service
- AWSConfigUserAccessReader
Provides access to use AWS Config, including searching by tags on resources, and reading all tags. This does not provide permission to configure AWS Config, which requires administrative privileges.
- AWSOrganizationsReadOnlyAccessReader
Provides read-only access to AWS Organizations.
- AWSSupportAppReadOnlyAccessReader
Provides read-only access to the AWS Support App.
- AWSTrustedAdvisorPriorityReadOnlyAccessReader
Provides read-only access to AWS Trusted Advisor Priority. This includes permission to view the delegated administrator accounts.
- ComputeOptimizerReadOnlyAccessReader
Provides read only access to ComputeOptimizer.
Service roles (2)
Organizations (1)
- AWSConfigRoleForOrganizationsReader
Allows AWS Config to call read-only AWS Organizations APIs
Other services (1)
- AWSArtifactAccountSyncReader
Allows AWS Artifact read-only access to operations in AWS Organizations.
Service-linked roles (22)
Organizations (8)
- AWSCODAServiceRolePolicyReader
Allows AWS CODA to monitor the deployment of delegations on your behalf.
- AWSManagedServices_SelfServiceReporting_ServiceRolePolicyReader
Allows Amazon's AWS Managed Service's Self Service Reporting feature to read AWS Organization data on your behalf to enable organization level aggregated reporting
- AWSServiceRoleForProcurementInsightsPolicyReader
Policy for Procurement Insights to obtain Organization Account details
- AWSWellArchitectedAgentOrganizationsServiceRolePolicyReader
Allows AWS Well-Architected Agent to access organizational structure and delegated administrator information in AWS Organizations on your behalf
- AWSWellArchitectedOrganizationsServiceRolePolicyReader
Allows Well-Architected to access Organizations on your behalf.
- AWSZoneGroupAccessManagementServiceRolePolicyReader
Provides read-only access to the APIs needed to support zone-group access-management for organizations.
- Health_OrganizationsServiceRolePolicyReader
AWS Health policy to enable Organizational View feature
- SplitCostAllocationDataServiceRolePolicyReader
Allows split cost allocation data to retrieve AWS Organizations information, if applicable, and collect telemetry data for the split cost allocation data services that the customer has opted in to.
Systems Manager (1)
- AWSSystemsManagerAccountDiscoveryServicePolicyReader
Grants AWS Systems Manager (SSM) permission to discover AWS account information.
Service Catalog (1)
- AWSServiceCatalogOrgsDataSyncServiceRolePolicyReader
A Service Linked Role Policy for AWS ServiceCatalog to sync with AWS Organizations organization structure
Account (1)
- AccountAccessManagerServiceRolePolicyReader
Grants account access manager permissions to manage AWS account access
Data Exchange (1)
- AWSDataExchangeServiceRolePolicyForOrganizationDiscoveryReader
Allows AWS Data Exchange to read data about your AWS Organization to determine eligibility for AWS Data Exchange data grants license distribution.
EKS (1)
- AmazonEKSDashboardServiceRolePolicyReader
This policy enables the Amazon EKS Dashboard to access and display organization-wide information. The policy allows the EKS Dashboard service to gather information about your AWS Organizations structure and accounts.
Other services (9)
- AmazonDetectiveServiceLinkedRolePolicyReader
Allows Amazon Detective to make service calls on your behalf
- AWSArtifactServiceRolePolicyReader
Allows AWS Artifact to gather information about an organization via AWS Organizations service.
- AWSEC2CapacityManagerServiceRolePolicyReader
Allows EC2 Capacity Manager to manage capacity resources and integrate with AWS Organizations on your behalf.
- AWSResilienceHubServiceRolePolicyReader
Allows AWS Resilience Hub to access resources in your account for resilience discovery, assessment, and management.
- AWSTrustedAdvisorReportingServiceRolePolicyReader
Service Policy for Trusted Advisor Multi-account Reporting
- CostOptimizationHubServiceRolePolicyReader
Allows Cost Optimization Hub to retrieve organization information and collect optimization-related data and metadata.
- ResourceGroupsServiceRolePolicyReader
Allows AWS Resource Groups to query the AWS services that own your resources to keep the group up-to-date
- S3StorageLensServiceRolePolicyReader
Enables access to AWS services and Resources used or managed by S3 Storage Lens
- TagsHealthServiceRolePolicyReader
Provides read-only access to the AWS Resource Groups Tagging API for the Tags Health service-linked role.
Also relevant to Management & Governance (16)
- AccessAnalyzerServiceRolePolicyReader
Allow Access Analyzer to analyze resource metadata
- AmazonDynamoDBReadOnlyAccessReader
Provides read only access to Amazon DynamoDB via the AWS Management Console.
- AmazonEC2ImageReferencesAccessPolicyReader
Provides read-only access to scan all supported resource types for relevant data when using DescribeImageReferences.
- AmazonGuardDutyReadOnlyAccessReader
Provides read only access to Amazon GuardDuty resources
- AmazonInspector2ReadOnlyAccessReader
Provides read only access to the Amazon inspector2 service and relevant support services
- AmazonKeyspacesReadOnlyAccessReader
Provide read only access to Amazon Keyspaces
- AmazonKeyspacesReadOnlyAccess_v2Reader
Provide read only access to Amazon Keyspaces and related AWS services.
- AWSAppMeshReadOnlyReader
Provides read-only access to the AWS App Mesh APIs and Management Console.
- AWSArtifactAgreementsReadOnlyAccessReader
This policy grants read-only access to list the AWS Artifact service agreements and to download the accepted agreements.. It also includes permissions to list as well as describe the organization details. Additionally, the policy provides t…
- AWSBillingConductorReadOnlyAccessReader
Use the AWSBillingConductorReadOnlyAccess managed policy to allow read only access to AWS Billing Conductor (ABC) console and APIs. This policy grants permission to view and list all ABC resources. It does not include the ability to create …
- AWSElasticDisasterRecoveryReadOnlyAccessReader
You can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities. This policy provides permissions to all read-only public APIs of Elastic Disaster Recovery (DRS), as well as some read-only APIs of other AWS service…
- AWSIncidentManagerIncidentAccessServiceRolePolicyReader
Grants Incident Manager permissions to call other AWS services as a part of managing an incident.
- AWSManagedServices_ContactsServiceRolePolicyReader
Allows AWS Managed Services to read the values of the tags on AWS resources
- AWSManagedSettingsReadOnlyAccessReader
Grants team members read-only access to AWS Settings, including workspace and owner information, team membership, plan and spend summary. It does not grant permissions to modify workspace configuration or to manage billing and payments.
- AWSNetworkManagerServiceRolePolicyReader
Allow NetworkManager to access resources associated with your Global Networks
- IAMAccessAdvisorReadOnlyReader
This policy grants access to read all access information provided by IAM access advisor such as service last accessed information.