Networking & Content Delivery: Operator policies
Virtual networking, DNS, load balancing, API front doors and media delivery.
35 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review. 6 are service-linked role policies, shown with permission data only.
Operator and limited (25)
Elemental Media (7)
- AWSElementalMediaConnectCreateBridgeOperator
Provides full access to create MediaConnect Gateway Bridges and all its associated sub-resources.
- AWSElementalMediaConnectCreateFlowOperator
Provides full access to create MediaConnect Flows and all its associated sub-resources.
- AWSElementalMediaConnectDeleteBridgeOperator
Provides full access to delete MediaConnect Gateway Bridges and all its associated sub-resources.
- AWSElementalMediaConnectDeleteFlowOperator
Provides full access to delete MediaConnect Flows and all its associated sub-resources.
- AWSElementalMediaStoreFullAccessOperator
Provides full read and write access to all MediaStore APIs
- ElementalActivationsGenerateLicensesOperator
Access to view purchased assets and generate software licenses for pending activations
- MediaConnectGatewayInstanceRolePolicyOperator
This policy grants permission to register MediaConnect Gateway Instances to a MediaConnect Gateway.
Elastic Container Service (3)
- AmazonECSInfrastructureRoleForGatewayHostSharedALBOperator
Default policy for the Amazon ECS Infrastructure Role for Amazon ECS Service Gateway Services.
- AmazonECSInfrastructureRolePolicyForLoadBalancersOperator
Provides access to other AWS service resources required to manage load balancers associated with ECS workloads on your behalf.
- AmazonECSInfrastructureRolePolicyForVpcLatticeOperator
Provides access to other AWS service resources required to manage VPC Lattice feature in ECS workloads on your behalf.
Route 53 (3)
- AmazonRoute53AutoNamingRegistrantAccessOperator
Provides registrant level access to Route 53 Auto Naming actions.
- AmazonRoute53RecoveryClusterFullAccessOperator
Provides full access to Amazon Route 53 Recovery Cluster
- ROSASharedVPCRoute53PolicyOperator
Allows the Red Hat OpenShift Service on AWS (ROSA) installer to configure Route53 records. Intended to be used on a shared VPC.
API Gateway (2)
- AmazonAPIGatewayAdministratorOperator
Provides full access to create/edit/delete APIs in Amazon API Gateway via the AWS Management Console.
- AmazonAPIGatewayInvokeFullAccessOperator
Provides full access to invoke APIs in Amazon API Gateway.
CodeDeploy (2)
- AWSCodeDeployRoleForECSOperator
Provides CodeDeploy service wide access to perform an ECS blue/green deployment on your behalf. Grants full access to support services, such as full access to read all S3 objects, invoke all Lambda functions, publish to all SNS topics withi…
- AWSCodeDeployRoleForECSLimitedOperator
Provides CodeDeploy service limited access to perform an ECS blue/green deployment on your behalf.
EKS (2)
- AmazonEKSClusterPolicyOperator
This policy provides Kubernetes the permissions it requires to manage resources on your behalf. Kubernetes requires Ec2:CreateTags permissions to place identifying information on EC2 resources including but not limited to Instances, Securit…
- AmazonEKSLoadBalancingPolicyOperator
Policy attached to the EKS Cluster Role that grants permissions to manage the cluster's load balancing resources.
Other services (6)
- AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicyOperator
Grants permissions to ARC Region switch for plan execution and plan evaluation.
- AmazonElasticTranscoder_JobsSubmitterOperator
Grants users permission to change presets, submit jobs, and view Elastic Transcoder settings. This policy also grants some read-only access to some other services required to use the Elastic Transcode console, including S3, IAM, and SNS.
- AWSCloudMapRegisterInstanceAccessOperator
Provides registrant level access to AWS Cloud Map actions.
- AWSForWordPressPluginPolicyOperator
Managed policy for AWS For Wordpress Plugin
- AWSResilienceHubV2AssessmentExecutionPolicyOperator
Allows AWS Resilience Hub to access resources in your account for resilience discovery, assessment, and management. This policy grants wildcarded read-only permissions that may include sensitive information in the output.
- VPCLatticeServicesInvokeAccessOperator
Provides access to invoking Amazon VPC Lattice services.
Service roles (4)
- AmazonECSInfrastructureRoleforExpressGatewayServicesOperator
These permissions enable Amazon ECS to automatically provision and manage the infrastructure components required for Express Gateway Services, including load balancing, security groups, SSL certificates, and auto scaling configurations.
- AmazonEMRServicePolicyForSessionsOperator
Provides permissions to provision and manage Network Load Balancers, VPC endpoint services, and security groups required for Amazon EMR Spark Connect interactive sessions on EMR on EC2 clusters.
- ROSAIngressOperatorPolicyOperator
Allows the OpenShift Ingress Operator to provision and manage load balancers and domain name system (DNS) configurations for Red Hat OpenShift Service on AWS (ROSA) clusters. The policy allows read access to tag values, which the operator f…
- ROSAKubeControllerPolicyOperator
Allows the ROSA Kubernetes controller to manage Amazon EC2, Elastic Load Balancing (ELB), and AWS Key Management Service (KMS) resources for a ROSA cluster.
Service-linked roles (6)
- AWSBedrockAgentCoreGatewayNetworkServiceRolePolicyOperator
Allows Bedrock AgentCore Gateway to managed VPC Lattice resources on your behalf
- AWSBedrockAgentCoreIdentityNetworkServiceRolePolicyOperator
Allows Bedrock AgentCore Identity to managed VPC Lattice resources on your behalf
- AWSMigrationHubRefactorSpacesServiceRolePolicyOperator
Provides access to AWS Resources managed or used by AWS Migration Hub Refactor Spaces.
- AWSSecurityAgentServiceRolePolicyOperator
Allows AWS Security Agent to manage resources on your behalf.
- AWSServiceRoleForAIDevOpsPolicyOperator
This Service Linked Role provides AIDevOps ability to provide usage information.
- AWSZonalAutoshiftPracticeRunSLRPolicyOperator
Provides administrative access for ARC zonal shift practice runs, and access to CloudWatch alarm statuses to monitor practice runs.
Also relevant to Networking & Content Delivery (55)
- AmazonEC2ContainerServiceRoleOperator
Default policy for Amazon ECS service role.
- AmazonEC2SpotFleetTaggingRoleOperator
Allows EC2 Spot Fleet to request, terminate and tag Spot Instances on your behalf.
- AmazonECSServiceRolePolicyOperator
Policy to enable Amazon ECS to manage your cluster.
- AmazonEKSServiceRolePolicyOperator
A Service-Linked Role required for Amazon EKS to call AWS services on your behalf.
- AmazonElasticsearchServiceRolePolicyOperator
Allow Amazon Elasticsearch Service to access other AWS services such as EC2 Networking APIs on your behalf.
- AmazonEMRContainersServiceRolePolicyOperator
Allows access to other AWS service resources that are required to run Amazon EMR
- AmazonInspector2ServiceRolePolicyOperator
Grants Amazon Inspector access to AWS services needed to perform security assessments
- AmazonODBServiceRolePolicyOperator
Allows Oracle Database@AWS to manage AWS resources on your behalf.
- AmazonOpenSearchServiceRolePolicyOperator
Allow Amazon OpenSearch Service to access other AWS services such as EC2 Networking APIs on your behalf.
- AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicyOperator
Service role policy used by the AWS CloudFormation within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including Lambda, APIGateway and others.
- AmazonVPCNetworkAccessAnalyzerFullAccessPolicyOperator
Provides permissions to describe AWS resources, run Network Access Analyzer, and create or delete tags on Network Insights Access Scope and Network Insights Access Scope Analysis.
- AmazonVPCReachabilityAnalyzerFullAccessPolicyOperator
Provides permissions to describe AWS resources, run Reachability Analyzer, and create or delete tags on Network Insights Path and Network Insights Analysis.
- APIGatewayServiceRolePolicyOperator
Allows API Gateway to manage associated AWS Resources on behalf of the customer.
- AutoScalingServiceRolePolicyOperator
Enables access to AWS services and Resources used or managed by Auto Scaling
- AWS_ConfigRoleOperator
Default policy for AWS Config service role. Provides permissions required for AWS Config to track changes to your AWS resources.
- AWSApplicationAutoScalingCustomResourcePolicyOperator
Policy granting permissions to Application Auto Scaling to access APIGateway and CloudWatch for custom resource scaling
- AWSApplicationMigrationFSxProxyVPCPolicyOperator
Provides permissions to manage PrivateLink between AWS Application Migration Service and customer's FSx file system
- AWSApplicationMigrationNetworkMigrationMultiAccountOperator
Provides permissions to automate VMware to AWS network infrastructure migration through CloudFormation
- AWSCloudFrontVPCOriginServiceRolePolicyOperator
Allows CloudFront to manage EC2 Elastic Network Interfaces and Security Groups on your behalf.
- AWSCodeDeployRoleOperator
Provides CodeDeploy service access to expand tags and interact with Auto Scaling on your behalf.
- AWSConfigServiceRolePolicyOperator
Allows Config to call AWS services and collect resource configurations on your behalf.
- AWSContinuumCollectorServiceRolePolicyOperator
Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.
- AWSEC2SpotFleetServiceRolePolicyOperator
Allows EC2 Spot Fleet to launch and manage spot fleet instances
- AWSElasticBeanstalkEKSTaggingOperator
Permissions needed to pass through tags to resources created by EKS Controllers
- AWSElasticBeanstalkEnhancedHealthOperator
AWS Elastic Beanstalk Service policy for Health Monitoring system
- AWSElasticBeanstalkMaintenanceOperator
AWS Elastic Beanstalk Service Role policy that grants limited permissions to update your resources on your behalf for maintenance purposes.
- AWSElasticBeanstalkServiceRolePolicyOperator
AWS Elastic Beanstalk Service Linked Role policy which grants permissions to create & manage resources (i.e.: AutoScaling, EC2, S3, CloudFormation, ELB, etc.) on your behalf.
- AWSGlobalAcceleratorSLRPolicyOperator
Policy granting permissions to AWS Global Accelerator to manage EC2 Elastic Network Interfaces and Security Groups.
- AWSIPAMServiceRolePolicyOperator
Allows VPC IP Address Manager to access VPC resources and integrate with AWS Organizations on your behalf.
- AWSLambdaReplicatorOperator
Grants Lambda Replicator necessary permissions to replicate functions across regions
- AWSLicenseManagerUserSubscriptionsServiceRolePolicyOperator
Allows AWS License Manager User Subscriptions Service to manage resources on your behalf.
- AWSM2ServicePolicyOperator
Allows AWS M2 to manage AWS resources on your behalf.
- AWSMigrationHubOrchestratorPluginOperator
Provides limited access to Amazon Simple Storage Service, AWS Secrets Manager and Plugin related actions for AWS Migration Hub Orchestrator.
- AWSMobileHub_FullAccessOperator
This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicyOperator
Provides access to manage AWS Config recorder resource and telemetry settings on AWS resources including logs, metrics.
- AWSPartnerLedSupportReadOnlyAccessOperator
This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci…
- AWSReachabilityAnalyzerServiceRolePolicyOperator
Allows VPC Reachability Analyzer to access AWS resources and integrate with AWS Organizations on your behalf.
- AWSResilienceHubAsssessmentExecutionPolicyOperator
Policy for AWS Resilience Hub service role which allows access to other AWS services in order to execute assessment.
- AWSResilienceHubResilienceTestingPolicyOperator
Policy for AWS Resilience Hub service role which allows access to AWS Fault Injection Service in order to start resilience testing.
- AWSShieldServiceRolePolicyOperator
Allows AWS Shield to access AWS resources on your behalf to provide DDoS protection.
- AWSTransformNetworkMigrationAgentPolicyOperator
Grants permissions for AWS Transform to deploy and configure network infrastructure including VPCs, Transit Gateways, and route tables for network migration
- AWSWellArchitectedAgentResourceScanningServiceRolePolicyOperator
Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
Cloudwatch Application Insights Service Linked Role Policy
- CloudWatchInternetMonitorFullAccessOperator
Provides full access to actions for working with Amazon CloudWatch Internet Monitor. Also provides access to other services, such as Amazon CloudWatch, Amazon EC2, Amazon CloudFront, Amazon WorkSpaces, and Elastic Load Balancing, that are n…
- CloudWatchInternetMonitorServiceRolePolicyOperator
Allows Internet Monitor to access EC2, Workspaces, and CloudFront resources, and other required services on your behalf.
- CloudWatchNetworkFlowMonitorTopologyServiceRolePolicyOperator
You can't attach CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy to your IAM entities. This policy is attached to a service-linked role named AWSServiceRoleForNetworkFlowMonitor\_Topology, which generates topology snapshots of resourc…
- CloudWatchOmniAWSIntegrationPolicyOperator
Provides permissions required by CloudWatch Omni to discover and read AWS resource topology
- FMSServiceRolePolicyOperator
Access policy to allow FM service linked role to perform FM-related actions on FM-managed resources within a customer AWS Organization account.
- NetworkSecurityDirectorServiceLinkedRolePolicyOperator
Provides permissions for the AWS Shield network security director service linked role to assess specified environments.
- NetworkSecurityManagerServiceRolePolicyOperator
Access policy to allow NetworkSecurityManager service linked role to perform NetworkSecurityManager-related actions on NetworkSecurityManager-managed resources within a customer AWS account.
- ResourceGroupsTaggingAPITagUntagSupportedResourcesOperator
Provides permissions to tag and untag all the resources supported by Resource Groups Tagging API. This policy also grants the permissions required to retrieve all tagged, or previously tagged, resources through the Resource Groups Tagging A…
- ROSAControlPlaneOperatorPolicyOperator
Allows Red Hat OpenShift Service on AWS (ROSA) control plane to manage ROSA cluster Amazon EC2 and Amazon Route 53 resources.
- ROSAInstallerPolicyOperator
Allows the Red Hat OpenShift Service on AWS (ROSA) installer to manage AWS resources that support ROSA cluster installation. This includes managing instance profiles for ROSA worker nodes.
- ROSASRESupportPolicyOperator
Provides ROSA site reliability engineering (SRE) the permissions needed to initially observe, diagnose, and support AWS resources associated with Red Hat OpenShift Service on AWS (ROSA) clusters, including the ability to change ROSA cluster…
- Route53RecoveryReadinessServiceRolePolicyOperator
Service Linked Role Policy for Route 53 Recovery Readiness