Privileged: Admin policies

Provides full access to AWS services and resources.

Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events.

AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.

Provides full access to AWS services and resources, but does not allow management of Users and groups.

Provides access within AWS SSO to manage AWS Organizations master and member accounts and cloud application

Provides access within AWS SSO to manage AWS Organizations member accounts and cloud application

Provides full access to Amazon DynamoDB via the AWS Management Console.

Provides full access to Amazon DynamoDB

This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req…

Provides full access to all buckets via the AWS Management Console.

Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch L…

Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in your account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of Sag…

Provides full access to manage Amazon Timestream using the AWS Management Console. Note that this policy also grants permissions for certain KMS operations, and operations to manage your saved queries. If using Customer managed CMK, please …

Provides full access to Amazon Timestream. Note that this policy also grants certain KMS operation access. If using Customer managed CMK, please refer to documentation for additional permissions needed.

Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications.

This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…

Allows full access to use the RDS data APIs, secret store APIs for RDS database credentials, and DB console query management APIs to execute SQL statements on Aurora Serverless clusters in the AWS account.

This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.

Provides full access to AWS Organizations.

Provides full access to IAM via the AWS Management Console.