Monitoring & Observability: Switch between the hub and domains
Monitoring & Observability policies
Metrics, logs, traces and application and network monitoring.
132 AWS managed policies. 7 have reviewed guidance; the rest have authoritative permission data pending editorial review. 57 are service-linked role policies, shown with permission data only.
Loading map…
Loading map
User access (27)
CloudWatch (15)
- AmazonCloudWatchRUMFullAccessAdmin
Grants full access permissions for the Amazon CloudWatch RUM service
- AmazonCloudWatchRUMReadOnlyAccessReader
Grants read only permissions for the Amazon CloudWatch RUM service
- CloudWatchApplicationInsightsFullAccessAdmin
Provides full access to CloudWatch Application Insights and required dependencies.
- CloudWatchApplicationInsightsReadOnlyAccessReader
Provides read only access to CloudWatch Application Insights.
- CloudWatchApplicationSignalsFullAccessAdmin
Provide full access to CloudWatch Application Signals service and scoped access to the dependencies needed to use and operate this service.
- CloudWatchApplicationSignalsReadOnlyAccessAnalyst
Provides read only access to CloudWatch Application Signals service and scoped access to the dependencies needed to use this service
- CloudWatchFullAccessAdmin
Provides full access to CloudWatch.
- CloudWatchFullAccessV2Admin
Provides full access to CloudWatch.
- CloudWatchInternetMonitorReadOnlyAccessAnalyst
Provides read only access to actions for working with Amazon CloudWatch Internet Monitor. Also provides access to other services in Amazon CloudWatch, including policies to retrieve information on CloudWatch metrics and to manage log querie…
- CloudWatchLogsFullAccessAdmin
Provides full access to CloudWatch Logs
- CloudWatchLogsReadOnlyAccessAnalyst
Provides read only access to CloudWatch Logs
- CloudWatchSyntheticsFullAccessAdmin
Provides full access to CloudWatch Synthetics.
- CloudWatchSyntheticsReadOnlyAccessReader
Provides read only access to CloudWatch Synthetics.
- OAMFullAccessAdmin
Provides full access to CloudWatch Observability Access Manager
- OAMReadOnlyAccessReader
Provides Read Only access to CloudWatch Observability Access Manager
DevOps Guru (3)
- AmazonDevOpsGuruConsoleFullAccessAdmin
The policy grants full-access to the DevOps Guru console.
- AmazonDevOpsGuruFullAccessAdmin
Provides full access to Amazon DevOps Guru.
- AmazonDevOpsGuruReadOnlyAccessReader
Provides read only access to Amazon DevOps Guru Console.
AMP (2)
- AmazonPrometheusFullAccessAdmin
Grants full access to AWS Managed Prometheus resources
- AmazonPrometheusQueryAccessReader
Grants access to run queries against AWS Managed Prometheus resources
X-Ray (2)
- AWSXrayFullAccessAdmin
AWS X-Ray full access managed policy
- AWSXrayReadOnlyAccessReader
AWS X-Ray read only managed policy
Other services (5)
- AmazonBraketFullAccessAdmin
Provides full access to Amazon Braket via the AWS Management Console and SDK. Also provides access to related services (e.g., S3, logs).
- AmazonRedshiftReadOnlyAccessReader
Provides read only access to Amazon Redshift via the AWS Management Console.
- AWSGrafanaAccountAdministratorAdmin
Provides access within Amazon Grafana to create and manage workspaces for the entire organization.
- AWSGrafanaConsoleReadOnlyAccessReader
Access to read only operations in Amazon Grafana.
- AWSPanoramaFullAccessAdmin
Provides full access to AWS Panorama
Operator and limited (29)
CloudWatch (16)
- AmazonCloudWatchEvidentlyFullAccessOperator
Provides full only access to Amazon CloudWatch Evidently. Also provides access to related Amazon S3, Amazon SNS, Amazon CloudWatch, and other related services.
- AWSThinkboxAWSPortalGatewayPolicyOperator
This policy grants the AWS Portal Gateway machine the necessary permissions required for normal operation.
- AWSThinkboxAWSPortalWorkerPolicyOperator
This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.
- CloudWatchAgentAdminPolicyOperator
Full permissions required to use AmazonCloudWatchAgent.
- CloudWatchAgentServerPolicyOperator
Permissions required to use AmazonCloudWatchAgent on servers
- CloudWatchAPIKeyAccessOperator
Grants permissions to call CloudWatch using API key authentication.
- CloudWatchCrossAccountSharingConfigurationOperator
Provides capabilities to manage Observability Access Manager links and establish sharing of CloudWatch resources
- CloudWatchInternetMonitorFullAccessOperator
Provides full access to actions for working with Amazon CloudWatch Internet Monitor. Also provides access to other services, such as Amazon CloudWatch, Amazon EC2, Amazon CloudFront, Amazon WorkSpaces, and Elastic Load Balancing, that are n…
- CloudWatchLambdaApplicationSignalsExecutionRolePolicyOperator
Provides write access to X-Ray and CloudWatch Application Signals log group.
- CloudWatchLambdaInsightsExecutionRolePolicyOperator
Policy required for the Lambda Insights Extension
- CloudWatchLogsCrossAccountSharingConfigurationOperator
Provides capabilities to manage Observability Access Manager links and establish sharing of CloudWatch Logs resources
- CloudWatchNetworkFlowMonitorAgentPublishPolicyOperator
You can use this policy in IAM roles that are attached to Amazon EC2 and Amazon EKS instance resources to send telemetry reports (metrics) to a Network Flow Monitor endpoint.
- CloudWatchOmniDomainAccessPolicyOperator
Provides permissions required to manage CloudWatch Omni domain access.
- CloudWatchOmniSpaceAccessPolicyOperator
Provides access to manage CloudWatch Omni spaces, view Applications Telemetry, and other Observability and Monitoring features through the new CloudWatch Omni Product
- CloudWatchReadOnlyAccessOperator
Provides read only access to CloudWatch.
- GameLiftContainerFleetPolicyOperator
Grants the required permissions for compute actions in an Amazon GameLift container fleet, including access to dependencies such as Amazon S3.
X-Ray (3)
- AWSXRayAPIKeyAccessOperator
Grants permissions to call AWS X-Ray using API key authentication.
- AWSXRayDaemonWriteAccessOperator
Allow the AWS X-Ray Daemon to relay raw trace segments data to the service's API and retrieve sampling data (rules, targets, etc.) to be used by the X-Ray SDK.
- AWSXrayWriteOnlyAccessOperator
AWS X-Ray write only managed policy
AMP (2)
- AmazonPrometheusConsoleFullAccessOperator
Grants full access to AWS Managed Prometheus resources in the AWS console
- AmazonPrometheusRemoteWriteAccessOperator
Grants write only access to AWS Managed Prometheus workspaces
SageMaker (2)
- AmazonSageMakerClusterInstanceRolePolicyOperator
This policy grants permissions commonly needed to use Amazon SageMaker Cluster.
- AmazonSageMakerHyperPodObservabilityAdminAccessOperator
This policy provides administrative privileges required for setting up SageMaker HyperPod observability. It enables access to Amazon Managed Prometheus, Amazon Managed Grafana and EKS Addons. The policy also includes broad access to Grafana…
Other services (6)
- AmazonCognitoUnauthenticatedIdentitiesOperator
This policy defines the set of permissions allowed for unauthenticated identities for Cognito Identity Pools. This does not need to be attached to your unauth role, as Cognito Identity Service will automatically include it as a scoped down …
- AWSElasticBeanstalkEKSObservabilityOperator
Observability permissions for Elastic Beanstalk environments running in Elastic Kubernetes Service cluster
- AWSIoTWirelessLoggingOperator
Allows the associated identity to create Amazon CloudWatch Logs groups and stream logs to the groups.
- AWSLambdaExecuteOperator
Provides Put, Get access to S3 and full access to CloudWatch Logs.
- AWSProtonCodeBuildProvisioningBasicAccessOperator
Permissions CodeBuild needs to run a build for AWS Proton CodeBuild Provisioning.
- AWSXrayCrossAccountSharingConfigurationOperator
Provides capabilities to manage Observability Access Manager links and establish sharing of X-Ray traces
Service roles (19)
CloudWatch (4)
- AmazonAPIGatewayPushToCloudWatchLogsOperator
Allows API Gateway to push logs to user's account.
- AmazonGrafanaCloudWatchAccessAnalyst
This policy grants access to Amazon CloudWatch and the dependencies needed to use CloudWatch as a datasource within Amazon Managed Grafana.
- AWSAppSyncPushToCloudWatchLogsOperator
Allows AppSync to push logs to user's CloudWatch account.
- AWSTransferLoggingAccessOperator
Allows AWS Transfer full access to create log streams and groups and put log events to your account
Lambda (4)
- AmazonS3ObjectLambdaExecutionRolePolicyOperator
Provides AWS Lambda functions permissions to interact with Amazon S3 Object Lambda. Also grants Lambda permissions to write to CloudWatch Logs.
- AWSLambdaBasicDurableExecutionRolePolicyOperator
Provides write permissions to CloudWatch Logs and read/write permissions to durable execution APIs used by Lambda durable functions
- AWSLambdaBasicExecutionRoleOperator
Provides write permissions to CloudWatch Logs.
- AWSLambdaSQSQueueExecutionRoleOperator
Provides receive message, delete message, and read attribute access to SQS queues, and write permissions to CloudWatch logs.
Panorama (2)
- AWSPanoramaApplianceRolePolicyOperator
Allows AWS IoT software on an AWS Panorama Appliance to upload logs to Amazon CloudWatch.
- AWSPanoramaApplianceServiceRolePolicyOperator
Allows an AWS Panorama Appliance to upload logs to Amazon CloudWatch, and to get objects from Amazon S3 access points created for use with AWS Panorama.
Service Catalog (2)
- AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicyOperator
Service role policy used by the AWS APIGateway within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CloudWatch Logs and others.
- AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator
Service role policy used by the AWS Glue within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Glue, S3 and others.
Other services (7)
- AmazonDMSCloudWatchLogsRoleOperator
Provides access to upload DMS replication logs to cloudwatch logs in customer account.
- AmazonEC2SpotFleetAutoscaleRoleOperator
Policy to enable Autoscaling for Amazon EC2 Spot Fleet
- AmazonRDSEnhancedMonitoringRoleOperator
Provides access to Cloudwatch for RDS Enhanced Monitoring
- AmazonSNSRoleOperator
Default policy for Amazon SNS service role.
- AWSControlTowerCloudTrailRolePolicyOperator
AWS Control Tower enables AWS CloudTrail as a best practice and provides this role to AWS CloudTrail. AWS CloudTrail assumes this role to create and publish CloudTrail logs
- AWSElasticBeanstalkRoleCWLOperator
(Elastic Beanstalk operations role) Allows an environment to manage Amazon CloudWatch Logs log groups.
- AWSIoTLoggingOperator
Allows creation of Amazon CloudWatch Log groups and streaming logs to the groups
Service-linked roles (57)
CloudWatch (12)
- AmazonCloudWatchRUMServiceRolePolicyOperator
Grants permission to Amazon CloudWatch RUM Service to publish monitoring data to other relevant AWS services
- AmazonDocDB-ElasticServiceRolePolicyOperator
Allows Amazon DocumentDB-Elastic to manage AWS resources on your behalf.
- AmazonMQServiceRolePolicyOperator
Service Linked Role Policy for AWS Amazon MQ
- AuroraDsqlServiceLinkedRolePolicyOperator
Policy for Amazon Aurora DSQL Service Linked Role
- AWSApplicationAutoscalingAppStreamFleetPolicyOperator
Policy granting permissions to Application Auto Scaling to access AppStream and CloudWatch.
- AWSApplicationAutoscalingCassandraTablePolicyOperator
Policy granting permissions to Application Auto Scaling to access Cassandra and CloudWatch.
- AWSIotRoboRunnerServiceRolePolicyOperator
Allows AWS IoT RoboRunner to manage associated AWS Resources on behalf of the customer.
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicyOperator
Provides access to manage AWS Config recorder resource and telemetry settings on AWS resources including logs, metrics.
- AWSPrivateNetworksServiceRolePolicyOperator
Allows AWS Private Networks Service to manage resources on behalf of the customer.
- AWSServiceRoleForAWSTransformCustomOperator
Allows AWS Transform Custom to publish CloudWatch metrics to your account on your behalf.
- CloudWatchApplicationSignalsServiceRolePolicyOperator
Policy grants permission to CloudWatch Application Signals to collect monitoring and tagging data from other relevant AWS services.
- CloudWatchInternetMonitorServiceRolePolicyOperator
Allows Internet Monitor to access EC2, Workspaces, and CloudFront resources, and other required services on your behalf.
DataSync (2)
- AWSDataSyncDiscoveryServiceRolePolicyOperator
Allows DataSync Discovery to integrate with other AWS services on your behalf.
- AWSDataSyncServiceRolePolicyOperator
Allows DataSync to integrate with other AWS services on your behalf
DynamoDB (2)
- AWSApplicationAutoscalingDynamoDBTablePolicyOperator
Policy granting permissions to Application Auto Scaling to access DynamoDB and CloudWatch.
- DynamoDBCloudWatchContributorInsightsServiceRolePolicyOperator
Permissions required to support Amazon CloudWatch Contributor Insights for Amazon DynamoDB.
Elemental Media (2)
- AWSMediaTailorServiceRolePolicyOperator
Enable access to AWS Resources used or managed by MediaTailor
- MediaPackageServiceRolePolicyOperator
Allows MediaPackage to publish logs to CloudWatch
OpenSearch (2)
- AmazonOpenSearchDashboardsServiceRolePolicyOperator
Provides access to Amazon OpenSearch Dashboards Service to access other AWS services such as CloudWatch on your behalf
- AmazonOpenSearchServerlessServiceRolePolicyOperator
Allow Amazon OpenSearch Serverless to access other AWS services such as CloudWatch APIs on your behalf.
SageMaker (2)
- AmazonSageMakerCapacityReservationServiceRolePolicyOperator
This policy grants permissions to Amazon SageMaker Capacity Reservations to publish CloudWatch metrics into customer accounts for utilization visibility.
- AmazonSageMakerHyperPodServiceRolePolicyOperator
This policy grants permissions to Amazon SageMaker HyperPod to related AWS services such as Amazon EKS, Amazon CloudWatch etc.
ServerMigrationService (2)
- AWSServiceRoleForSMSOperator
Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.
- SMSVoiceServiceRolePolicyOperator
Allows SMSVoice to publish metrics to CloudWatch on your behalf
Other services (33)
- AmazonAthenaServiceRolePolicyOperator
Allows access to other AWS service resources that are required to run Amazon Athena
- AmazonBraketServiceRolePolicyOperator
Allows Amazon Braket to create and manage AWS resources on your behalf
- AmazonManagedBlockchainServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Amazon Managed Blockchain
- AmazonSESServiceRolePolicyOperator
Allows SES to publish Amazon CloudWatch basic monitoring metrics on behalf of your SES resources
- AmazonWorkMailEventsServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Amazon WorkMail Events
- AmazonWorkSpacesThinClientMonitoringServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Amazon WorkSpaces Thin Client Monitoring
- AWSAppConfigServiceRolePolicyOperator
Allows AWS AppConfig to call AWS services on your behalf.
- AWSApplicationAutoscalingComprehendEndpointPolicyOperator
Policy granting permissions to Application Auto Scaling to access Comprehend and CloudWatch.
- AWSApplicationAutoScalingCustomResourcePolicyOperator
Policy granting permissions to Application Auto Scaling to access APIGateway and CloudWatch for custom resource scaling
- AWSApplicationAutoscalingEC2SpotFleetRequestPolicyOperator
Policy granting permissions to Application Auto Scaling to access EC2 Spot Fleet and CloudWatch.
- AWSApplicationAutoscalingECSServicePolicyOperator
Policy granting permissions to Application Auto Scaling to access EC2 Container Service and CloudWatch.
- AWSApplicationAutoscalingEMRInstanceGroupPolicyOperator
Policy granting permissions to Application Auto Scaling to access Elastic Map Reduce and CloudWatch.
- AWSApplicationAutoscalingWorkSpacesPoolPolicyOperator
Policy granting permissions to Application Auto Scaling to access Amazon WorkSpaces and Amazon CloudWatch.
- AWSAppSyncServiceRolePolicyOperator
Enables access to AWS services and resources used or managed by AppSync
- AWSChatbotServiceLinkedRolePolicyOperator
The Service Linked Role used by AWS Chatbot.
- AWSCleanRoomsServiceRolePolicyOperator
Allow AWS Clean Rooms to access other AWS services such as CloudWatch APIs on your behalf.
- AWSCloudFrontLoggerOperator
Grants CloudFront Logger write permissions to CloudWatch Logs.
- AWSDMSFleetAdvisorServiceRolePolicyOperator
Allows DMS Fleet Advisor to manage CloudWatch metrics on your behalf.
- AWSFinSpaceServiceRolePolicyOperator
Policy to enable access to AWS service and Resources used or managed by Amazon FinSpace
- AWSHealthImagingServiceRolePolicyOperator
Provides permissions for AWS HealthImaging to manage service operations and publish service metrics
- AWSIoTFleetwiseServiceRolePolicyOperator
Grants permissions to AWS Resources and metaData used or managed by AWSIoTFleetwise for auxiliary features
- AWSIoTManagedIntegrationsRolePolicyOperator
Provides managed integrations for AWS IoT Device Management permission to publish logs and metrics on your behalf.
- AWSrePostPrivateCloudWatchAccessOperator
Provides re:Post Private access to publish CloudWatch metrics data
- AWSServiceRoleForNeptuneGraphPolicyOperator
Provides Cloudwatch access to publish operational and usage metrics and logs for Amazon Neptune
- AWSSocialMessagingServiceRolePolicyOperator
Provides access to publish metrics and provide insights for your social message sending.
- CloudHSMServiceRolePolicyOperator
Enables access to AWS resources used or managed by CloudHSM
- EndUserMessagingServiceRolePolicyOperator
Allows EndUserMessaging to publish metrics to CloudWatch on your behalf
- KeyspacesCDCServiceRolePolicyOperator
Grants the required permissions to Amazon Keyspaces for Change Data Capture
- MonitronServiceRolePolicyOperator
Policy for AWS Monitron service linked role granting access to required customer resources.
- NovaActServiceRolePolicyOperator
This policy allows NovaAct to create and manage the necessary resources to operate the Nova Act agents.
- QAppsServiceRolePolicyOperator
Grants permissions to AWS services and Resources used or managed by Amazon Q Apps.
- QBusinessServiceRolePolicyOperator
Grants permissions to AWS services and Resources used or managed by Amazon Q
- Route53ResolverServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Route53 Resolver
Also relevant to Monitoring & Observability (128)
- AlexaForBusinessGatewayExecutionOperator
Provide gateway execution access to AlexaForBusiness services
- AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicyOperator
Grants permissions to ARC Region switch for plan execution and plan evaluation.
- AmazonAuroraDSQLReadOnlyAccessReader
Provides read only access to Aurora DSQL
- AmazonBraketJobsExecutionPolicyOperator
Grants access to AWS services and resources necessary for executing an Amazon Braket Job including S3, Cloudwatch, IAM and Braket
- AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicyOperator
Managed Policy For Amazon Chime SDK MediaPipelines Service Linked Role
- AmazonDataZoneProjectRolePermissionsBoundaryAdmin
Amazon DataZone creates IAM roles for projects to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.
- AmazonDevOpsGuruOrganizationsAccessOperator
Provide access to enable and manage Amazon DevOps Guru within an organization.
- AmazonDevOpsGuruServiceRolePolicyOperator
A service-linked role required for Amazon DevOpsGuru to access your resources.
- AmazonDocDBElasticReadOnlyAccessReader
Provides read-only access to Amazon DocDB-Elastic and CloudWatch metrics.
- AmazonDocDBReadOnlyAccessReader
Provides read-only access to Amazon DocumentDB with MongoDB compatibility. Note that this policy also grants access to Amazon RDS and Amazon Neptune resources.
- AmazonEC2ContainerServiceAutoscaleRoleOperator
Policy to enable Task Autoscaling for Amazon EC2 Container Service
- AmazonEC2ContainerServiceforEC2RoleOperator
Default policy for the Amazon EC2 Role for Amazon EC2 Container Service.
- AmazonEC2FullAccessAdmin
Provides full access to Amazon EC2 via the AWS Management Console.
- AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin
Default policy for the Amazon EC2 Role for Data Pipeline service role.
- AmazonEC2RoleforSSMHigh privilegeOperator
This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userg…
- AmazonECSInfrastructureRoleforExpressGatewayServicesOperator
These permissions enable Amazon ECS to automatically provision and manage the infrastructure components required for Express Gateway Services, including load balancing, security groups, SSL certificates, and auto scaling configurations.
- AmazonECSTaskExecutionRolePolicyOperator
Provides access to other AWS service resources that are required to run Amazon ECS tasks
- AmazonEKSLocalOutpostClusterPolicyOperator
This policy provides permissions to EKS local cluster's control-plane instances running in your account to manage resources on your behalf.
- AmazonEKSMCPReadOnlyAccessAnalyst
Provides read-only access to the Amazon EKS MCP service. This policy grants permissions to use only read-only tools in the EKS MCP service meant for observability, troubleshooting, retrieving EKS resource information, and getting EKS-optimi…
- AmazonEKSServicePolicyOperator
This policy allows Amazon Elastic Container Service for Kubernetes to create and manage the necessary resources to operate EKS Clusters.
- AmazonElasticFileSystemsUtilsOperator
Allows customers to use AWS Systems Manager to automatically manage Amazon EFS utilities (amazon-efs-utils) package on their EC2 instances, and use CloudWatchLog to get EFS file system mount success/failure notifications.
- AmazonElasticMapReduceforAutoScalingRoleOperator
Amazon Elastic MapReduce for Auto Scaling. Role to allow Auto Scaling to add and remove instances from your EMR cluster.
- AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin
Default policy for the Amazon Elastic MapReduce for EC2 service role.
- AmazonElasticMapReduceFullAccessHigh privilegeAdmin
This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req…
- AmazonFSxConsoleReadOnlyAccessReader
Provides read only access to Amazon FSx and access to related AWS services via the AWS Management Console.
- AmazonFSxServiceRolePolicyOperator
Allows Amazon FSx to manage AWS resources on your behalf
- AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator
GuardDuty malware protection uses the service-linked role (SLR) named AWSServiceRoleForAmazonGuardDutyMalwareProtection. This service-linked role allows GuardDuty malware protection to perform agent-less scans to detect malware. It allows G…
- AmazonKeyspacesFullAccessAdmin
Provide full access to Amazon Keyspaces
- AmazonKeyspacesReadOnlyAccessReader
Provide read only access to Amazon Keyspaces
- AmazonKeyspacesReadOnlyAccess_v2Reader
Provide read only access to Amazon Keyspaces and related AWS services.
- AmazonKinesisAnalyticsReadOnlyReader
Provides read-only access to Amazon Kinesis Analytics via the AWS Management Console.
- AmazonLaunchWizard_FullaccessAdmin
Full access to AWS Launch wizard and other required services.
- AmazonLaunchWizardFullAccessV2Admin
Full access to AWS Launch wizard and other required services.
- AmazonLookoutVisionConsoleReadOnlyAccessReader
Provides read only access to Amazon Lookout for Vision and scoped access to required service and console dependencies.
- AmazonMacieServiceRolePolicyOperator
Service linked role for Amazon Macie
- AmazonMCSReadOnlyAccessReader
Provide read only access to Amazon Managed Apache Cassandra Service
- AmazonMonitronFullAccessAdmin
Provides full access to manage Amazon Monitron
- AmazonMWAAServiceRolePolicyOperator
The Service Linked Role used by Amazon Managed Workflows for Apache Airflow.
- AmazonODBServiceRolePolicyOperator
Allows Oracle Database@AWS to manage AWS resources on your behalf.
- AmazonOpenSearchIngestionServiceRolePolicyOperator
Allows Amazon OpenSearch Ingestion Service to access other AWS services on your behalf.
- AmazonPrometheusScraperServiceRolePolicyOperator
Provides access to AWS Resources managed or used by Amazon Managed Service for Prometheus Collector
- AmazonRDSBetaServiceRolePolicyOperator
Allows Amazon RDS to manage AWS resources on your behalf.
- AmazonRDSCustomInstanceProfileRolePolicyOperator
Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.
- AmazonRDSPerformanceInsightsFullAccessOperator
Provides full access to RDS Performance Insights via the AWS Management Console
- AmazonRDSPreviewServiceRolePolicyOperator
Amazon RDS Preview Service Role Policy
- AmazonRDSReadOnlyAccessReader
Provides read only access to Amazon RDS via the AWS Management Console.
- AmazonRedshiftFullAccessAdmin
Provides full access to Amazon Redshift via the AWS Management Console.
- AmazonRedshiftServiceLinkedRolePolicyOperator
Allows Amazon Redshift to call AWS services on your behalf
- AmazonSageMakerCanvasDirectDeployAccessOperator
Allows Amazon SageMaker Canvas to create, manage and view endpoint details for endpoints created through Canvas. Allows Amazon SageMaker Canvas to retrieve endpoint invocation metrics from CloudWatch.
- AmazonSageMakerGroundTruthExecutionOperator
Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job
- AmazonSecurityLakeMetastoreManagerOperator
Policy for Amazon SecurityLake meta store manager lambda which allows the access to cloudwatch, S3, Glue and SQS.
- AmazonSSMFullAccessAdmin
Provides full access to Amazon SSM.
- APIGatewayServiceRolePolicyOperator
Allows API Gateway to manage associated AWS Resources on behalf of the customer.
- ApplicationAutoScalingForAmazonAppStreamAccessOperator
Policy to enable Application Autoscaling for Amazon AppStream
- ApplicationDiscoveryServiceContinuousExportServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Application Discovery Service Continuous Export feature
- AppRunnerServiceRolePolicyOperator
Allows AWS AppRunner to manage related AWS resources on your behalf.
- AppStudioServiceRolePolicyOperator
Allows AppStudio to manage associated AWS resources on your behalf.
- AutoScalingConsoleReadOnlyAccessReader
Provides read-only access to Auto Scaling via the AWS Management Console.
- AWSAppFabricServiceRolePolicyOperator
Provides AppFabric access to AWS resources on your behalf
- AWSApplicationAutoscalingElastiCacheRGPolicyOperator
Policy granting permissions to Application Auto Scaling to access Amazon ElastiCache and Amazon CloudWatch.
- AWSApplicationAutoscalingKafkaClusterPolicyOperator
Policy granting permissions to Application Auto Scaling to access Managed Streaming for Apache Kafka and CloudWatch.
- AWSApplicationAutoscalingLambdaConcurrencyPolicyOperator
Policy granting permissions to Application Auto Scaling to access Lambda and CloudWatch.
- AWSApplicationAutoscalingNeptuneClusterPolicyOperator
Policy granting permissions to Application Auto Scaling to access Amazon Neptune and Amazon CloudWatch.
- AWSApplicationAutoscalingRDSClusterPolicyOperator
Policy granting permissions to Application Auto Scaling to access RDS and CloudWatch.
- AWSApplicationAutoscalingSageMakerEndpointPolicyOperator
Policy granting permissions to Application Auto Scaling to access SageMaker and CloudWatch.
- AWSAutoScalingPlansEC2AutoScalingPolicyOperator
Policy granting permissions to AWS Auto Scaling to periodically forecast capacity and generate scheduled scaling actions for Auto Scaling groups in a scaling plan
- AWSBatchFullAccessAdmin
Provides full access for AWS Batch resources.
- AWSCleanRoomsFullAccessNoQueryingOperator
Allows full access to AWS Clean Rooms resources except for querying in a collaboration and access to related AWS services.
- AWSCloudWatchOmniServiceRolePolicyOperator
Provides CloudWatch Omni access to manage AWS Config recorder resources, telemetry configurations, and supporting IAM roles for organization enablement.
- AWSCodeDeployRoleForLambdaOperator
Provides CodeDeploy service access to perform a Lambda deployment on your behalf.
- AWSCodeDeployRoleForLambdaLimitedOperator
Provides CodeDeploy service limited access to perform a Lambda deployment on your behalf.
- AWSConfigThirdPartyServiceRolePolicyOperator
Provides permissions for AWS Config to inventory and evaluate compliance of third-party cloud resources.
- AWSDeepLensLambdaFunctionAccessPolicyOperator
This policy specifies permissions required by DeepLens Administrative lambda functions that run on a DeepLens device
- AWSDiscoveryContinuousExportFirehosePolicyOperator
Provides write access to AWS resources required for AWS Discovery Continuous Export
- AWSElasticBeanstalkEKSImageBuildOperator
Permissions needed by Elastic Beanstalk to build container images on behalf of customer.
- AWSElasticBeanstalkEnhancedHealthOperator
AWS Elastic Beanstalk Service policy for Health Monitoring system
- AWSElasticBeanstalkServiceRolePolicyOperator
AWS Elastic Beanstalk Service Linked Role policy which grants permissions to create & manage resources (i.e.: AutoScaling, EC2, S3, CloudFormation, ELB, etc.) on your behalf.
- AWSElasticLoadBalancingServiceRolePolicyOperator
Service Linked Role Policy for AWS Elastic Load Balancing Control Plane
- AWSGlueDataBrewServiceRoleOperator
This policy grants permission to glue to perform action on user's glue data catalog, this policy also provides permission to ec2 actions to allow glue to create ENI to connect to resources in the VPC, also allow glue to access registered da…
- AWSGrafanaWorkspacePermissionManagementOperator
Provides only the ability to update user and group permissions for AWS Grafana workspaces.
- AWSGrafanaWorkspacePermissionManagementV2Operator
Provides ability to update IAM Identity Center (IdC) user and group permissions for Amazon Managed Grafana workspaces.
- AWSIncidentManagerServiceRolePolicyOperator
This policy grants Incident Manager permission to manage incident records and related resources on your behalf.
- AWSIoTFleetHubFederationAccessOperator
Federation access for IoT Fleet Hub applications
- AWSIoTRuleActionsHigh privilegeOperator
Allows access to all AWS services supported in AWS IoT Rule Actions
- AWSLambda_ReadOnlyAccessAnalyst
Grants read-only access to AWS Lambda service, AWS Lambda console features, and other related AWS services.
- AWSLambdaDynamoDBExecutionRoleOperator
Provides list and read access to DynamoDB streams and write permissions to CloudWatch logs.
- AWSLambdaFullAccessHigh privilegeAdmin
This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.
- AWSLambdaKinesisExecutionRoleOperator
Provides list and read access to Kinesis streams and write permissions to CloudWatch logs.
- AWSLambdaManagedEC2ResourceOperatorOperator
This policy grants permissions to to create and administer EC2 resources managed by the Lambda Managed Instances, and descriptive permissions.
- AWSLambdaMSKExecutionRoleOperator
Provides permissions required to access MSK Cluster within a VPC, manage ENIs (create, describe, delete) in the VPC and write permissions to CloudWatch Logs.
- AWSLambdaVPCAccessExecutionRoleOperator
Provides minimum permissions for a Lambda function to execute while accessing a resource within a VPC - create, describe, delete network interfaces and write permissions to CloudWatch Logs.
- AWSMediaLiveAnywhereServiceRolePolicyOperator
Allows MediaLive Anywhere to create and manage AWS resources on your behalf.
- AWSNetworkFirewallFullAccessOperator
Grants full access to AWS Network Firewall service, including permissions to create, configure, manage, and delete firewall resources, policies, and rule groups. Additionally includes permissions to modify VPC endpoints, S3 bucket policies,…
- AWSObservabilityAdminLogsCentralizationServiceRolePolicyOperator
Service-linked role permissions for CloudWatch Logs centralization
- AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
The AWSQuickSetupDevOpsGuruPermissionsBoundary policy defines the list of permissions that are permitted in an IAM role created by Quick Setup. Quick Setup uses a role created with this policy to enable and configure Amazon DevOps Guru. Thi…
- AWSRolesAnywhereServicePolicyOperator
Allows IAM Roles Anywhere to publish service/usage metrics to CloudWatch and check the status of Private Certificate Authorities on your behalf.
- AWSServiceRoleForAIDevOpsPolicyOperator
This Service Linked Role provides AIDevOps ability to provide usage information.
- AWSServiceRoleForAmazonQDeveloperOperator
This Service Linked Role provides Amazon Q Developer ability to provide usage information.
- AWSServiceRoleForIoTSiteWiseOperator
Allows AWS IoT SiteWise to provision and manage gateways as well as query data. The policy includes required AWS Greengrass permissions for deploying to groups, AWS Lambda permissions for creating and updating service-prefixed functions, an…
- AWSShieldDRTAccessPolicyAdmin
Provides the AWS DDoS Response Team with limited access to your AWS account to assist with DDoS attack mitigation during a high-severity event.
- AWSThinkboxAssetServerPolicyOperator
This policy grants the AWS Portal Asset Server the necessary permissions required for normal operation.
- AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator
Grants permissions required for the operation of AWS Thinkbox's Deadline Resource Tracker. This includes full access to some EC2 actions, including DeleteFleets and CancelSpotFleetRequests.
- AWSTransformApplicationECSDeploymentPolicyOperator
Enables the AWS Transform to deploy applications to Amazon Elastic Container Service (ECS) with Fargate. It grants permissions to provision, configure, and manage the underlying infrastructure required to run applications on ECS.
- AWSTransformInfrastructureExecutorAccessBatchOperator
Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch jo…
- AWSTransformSecurityAgentExecutorAccessOperator
Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.
- AWSZonalAutoshiftPracticeRunSLRPolicyOperator
Provides administrative access for ARC zonal shift practice runs, and access to CloudWatch alarm statuses to monitor practice runs.
- BedrockAgentCoreFullAccessOperator
Provides full access to Bedrock AgentCore as well as limited access to related services
- ClientVPNServiceRolePolicyOperator
Policy to enable AWS Client VPN to manage your Client VPN endpoints.
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
Cloudwatch Application Insights Service Linked Role Policy
- CloudWatchEventsServiceRolePolicyOperator
Allow AWS CloudWatch to execute actions on your behalf configured through alarms and events.
- CloudWatchLogsAPIKeyAccessOperator
Grants permissions to call CloudWatch Logs using API key authentication.
- CloudWatchNetworkFlowMonitorServiceRolePolicyOperator
You can't attach CloudWatchNetworkFlowMonitorServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor, which publishes network telemetry aggregation results, collecte…
- CloudWatchOpenSearchDashboardAccessOperator
This policy provides user access to view OpenSearch dashboards on the CloudWatch Logs console.
- CloudWatchOpenSearchDashboardsFullAccessOperator
This policy provides user access to create integration with OpenSearch to create, update, delete or view dashboards on the CloudWatch Logs console.
- CustomerProfilesServiceLinkedRolePolicyOperator
Allows Amazon Connect Customer Profiles to access AWS services and resources on your behalf.
- DatabaseAdministratorHigh privilegeAdmin
Grants full access permissions to AWS services and actions required to set up and configure AWS database services.
- EC2ApplicationStatusChecksServiceRolePolicyOperator
Enables EC2 to discover and manage resources related to EC2 Application Status Checks
- EC2InstanceProfileForImageBuilderOperator
EC2 Instance profile for Image Builder service.
- EC2InstanceProfileForImageBuilderECRContainerBuildsOperator
EC2 Instance profile for building container images with EC2 Image Builder. This policy grants the user broad permissions to upload ECR images.
- KeyspacesReplicationServiceRolePolicyOperator
Permissions required by Keyspaces for cross-region data replication
- MemoryDBServiceRolePolicyOperator
This policy allows MemoryDB to manage AWS resources on your behalf as necessary for managing your resources.
- NeptuneGraphReadOnlyAccessReader
Provides read only access to all Amazon Neptune Analytics resources along with read only permissions for dependent services.
- OpensearchIngestionSelfManagedVpcePolicyOperator
Allows Amazon OpenSearch Ingestion to describe network resources and write service metrics to cloudwatch
- SecurityLakeServiceLinkedRoleOperator
This policy grants permissions to operate the Amazon Security Lake service on your behalf
- ServiceQuotasFullAccessAdmin
Provides full access to Service Quotas
- SplitCostAllocationDataServiceRolePolicyReader
Allows split cost allocation data to retrieve AWS Organizations information, if applicable, and collect telemetry data for the split cost allocation data services that the customer has opted in to.
- SystemAdministratorHigh privilegeAdmin
Grants full access permissions necessary for resources required for application and development operations.
- TranslateReadOnlyReader
Provides read-only access to Amazon Translate.