Skip to main content
IAM Policy Map
IAM Policy Map
Privileged: Switch between the hub and domains
MapList

Can change permissions or pass roles: 19 of 32 policies: 15 unrestricted, 4 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 27 of 32 policies: 26 write, 1 read only, 0 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Privileged policies

Policies that carry the High privilege flag. Assigned by rule from tier-rules.yaml, not by service share.

32 AWS managed policies. 24 have reviewed guidance; the rest have authoritative permission data pending editorial review. 1 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (20)

Multi-service (4)

  • AdministratorAccessHigh privilegeAdmin

    Provides full access to AWS services and resources.

  • AIDevOpsAgentActionsPolicyHigh privilegeAdmin

    Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events.

  • AWSCODAPermissionsBoundaryHigh privilegeAdmin

    AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.

  • PowerUserAccessHigh privilegeAdmin

    Provides full access to AWS services and resources, but does not allow management of Users and groups.

Account (2)

DynamoDB (2)

S3 (2)

  • AmazonElasticMapReduceFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req…

  • AmazonS3FullAccessHigh privilegeAdmin

    Provides full access to all buckets via the AWS Management Console.

SageMaker (2)

  • SageMakerStudioAdminIAMPermissiveExecutionPolicyHigh privilegeAdmin

    Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch L…

  • SageMakerStudioUserIAMPermissiveExecutionPolicyHigh privilegeAdmin

    Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in your account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of Sag…

Timestream (2)

  • AmazonTimestreamConsoleFullAccessHigh privilegeAdmin

    Provides full access to manage Amazon Timestream using the AWS Management Console. Note that this policy also grants permissions for certain KMS operations, and operations to manage your saved queries. If using Customer managed CMK, please …

  • AmazonTimestreamFullAccessHigh privilegeAdmin

    Provides full access to Amazon Timestream. Note that this policy also grants certain KMS operation access. If using Customer managed CMK, please refer to documentation for additional permissions needed.

Other services (6)

  • AdministratorAccess-AmplifyHigh privilegeAdmin

    Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications.

  • AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…

  • AmazonRDSDataFullAccessHigh privilegeAdmin

    Allows full access to use the RDS data APIs, secret store APIs for RDS database credentials, and DB console query management APIs to execute SQL statements on Aurora Serverless clusters in the AWS account.

  • AWSLambdaFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.

  • AWSOrganizationsFullAccessHigh privilegeAdmin

    Provides full access to AWS Organizations.

  • IAMFullAccessHigh privilegeAdmin

    Provides full access to IAM via the AWS Management Console.

Operator and limited (4)

  • AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator

    Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator

    Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th…

  • AWSManagedControlPolicyManagementAccessHigh privilegeOperator

    Grants AWS permission to manage organization control policies for AWS managed accounts

  • ConsoleFullAccessFromVercelHigh privilegeOperator

    For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to manage all resources for the services that are integrated with the Vercel Marketplace.

Service roles (7)

  • AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin

    Default policy for the Amazon EC2 Role for Data Pipeline service role.

  • AmazonEC2RoleforSSMHigh privilegeOperator

    This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userg…

  • AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin

    Default policy for the Amazon Elastic MapReduce for EC2 service role.

  • AmazonElasticMapReduceRoleHigh privilegeOperator

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Default policy for the Amazon Elastic MapReduce service role.

  • AmazonElasticTranscoderRoleHigh privilegeOperator

    Default policy for the Amazon Elastic Transcoder service role.

  • AWSElasticBeanstalkServiceHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html. AWS Elastic Beanstalk Service role policy which grants permissions to create & manage resourc…

  • AWSIoTRuleActionsHigh privilegeOperator

    Allows access to all AWS services supported in AWS IoT Rule Actions

Service-linked roles (1)

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.