Skip to main content
IAM Policy Map
IAM Policy Map
Security, Identity & Compliance: Switch between the hub and domains
MapList

Can change permissions or pass roles: 28 of 209 policies: 0 unrestricted, 28 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 24 of 209 policies: 13 write, 10 read only, 1 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Security, Identity & Compliance policies

Identity, access, encryption, threat detection and compliance.

209 AWS managed policies. 21 have reviewed guidance; the rest have authoritative permission data pending editorial review. 42 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (61)

Inspector (6)

WAF, Firewall Manager and Shield (5)

  • AWSFMAdminFullAccessAdmin

    Full access for AWS FM Administrator

  • AWSFMAdminReadOnlyAccessReader

    Read only access for AWS FM Administrator that allows monitoring AWS FM operations

  • AWSFMMemberReadOnlyAccessReader

    Provides read only access to AWS WAF actions for AWS Firewall Manager member accounts

  • AWSWAFConsoleReadOnlyAccessAnalyst

    Provides read-only access to AWS WAF via the AWS Management Console. Note that this policy also grants permissions to list Amazon CloudFront distributions, permissions to view load balancers on AWS Elastic Load Balancing, permissions to vie…

  • AWSWAFReadOnlyAccessReader

    Provides read only access to AWS WAF actions.

Certificate Manager (4)

IAM (4)

Artifact (3)

Directory Service (3)

GuardDuty (3)

Vendor Insights (3)

Cloud Directory (2)

CloudHSM (2)

IAM Identity Center (2)

  • AWSManagedSettingsReadOnlyAccessReader

    Grants team members read-only access to AWS Settings, including workspace and owner information, team membership, plan and spend summary. It does not grant permissions to modify workspace configuration or to manage billing and payments.

  • AWSSSODirectoryAdministratorAdmin

    Administrator access for SSO Directory

Macie (2)

Network Firewall (2)

  • AmazonVPCReachabilityAnalyzerPathComponentReadPolicyReader

    This policy is attached to the role IAMRoleForReachabilityAnalyzerCrossAccountResourceAccess. This role is deployed to the member accounts in an organization when the management account enables trusted access for Reachability Analyzer. It p…

  • AWSNetworkFirewallReadOnlyAccessReader

    Provides read-only access to AWS Network Firewall resources via the AWS Management Console, CLI, and SDKs. This policy allows users to view and monitor firewall configurations, policies, rule groups, and associated resources, without the ab…

Private CA (2)

Resource Access Manager (2)

Security Incident Response (2)

  • AWSSecurityIncidentResponseFullAccessAdmin

    Policy provides customers with Read and Write permissions to all resources associated to the Security Incident Response service.

  • AWSSecurityIncidentResponseReadOnlyAccessReader

    Policy provides customers with Read-only permissions to all resources associated to the Security Incident Response service. Permission includes access to GetCaseAttachmentDownloadUrl as well for the ability to get case attachment download U…

SecurityHub (2)

Signin (2)

  • AWSMCPSignInOAuthAccessPolicyReader

    Provides access to authenticate to the AWS MCP server using AWS Sign-In OAuth

  • SignInLocalDevelopmentAccessReader

    Provides permissions for programmatic access to AWS through the AWS Sign-in service, including OAuth2 token creation for developer tools and applications.

Other services (10)

  • AmazonCognitoPowerUserAdmin

    Provides administrative access to existing Amazon Cognito resources. You will need AWS account admin privileges to create new Cognito resources.

  • AmazonDetectiveFullAccessAdmin

    Provides full access to Amazon Detective service and scoped access to the console UI dependencies

  • AmazonVerifiedPermissionsReadOnlyAccessReader

    Provides read-only access to the Verified Permissions service.

  • AWSAuditManagerAdministratorAccessAdmin

    Provides administrative access to enable or disable AWS Audit Manager, update settings, and manage assessments, controls, and frameworks

  • AWSIdentitySyncReadOnlyAccessReader

    Read only access to the Identity Sync service

  • AWSManagedSettingsAdminAccessAdmin

    Grants full administrative access to AWS account settings management. This policy allows owners to view and modify account information, billing, payments, tax registration, identity management, organization policies, budgets, cost analysis,…

  • AWSRolesAnywhereReadOnlyReader

    Provides read-only permissions to IAM Roles Anywhere resources, including but not limited to: GetTrustAnchor, ListProfiles, GetCRL. There will be no other permissions for other services included in this policy.

  • FinOpsAgentIdentityReaderPolicyReader

    Provides permissions required by AWS FinOps Agent to read IAM Identity Center user and group information and check group membership for agent access

  • MultiPartyApprovalFullAccessAdmin

    Provides full access to Multi-party approval. This policy also includes related permissions to AWS Organizations and AWS IAM Identity for managing approval teams and identity sources.

  • SecretsManagerReadWriteAdmin

    Provides read/write access to AWS Secrets Manager via the AWS Management Console. Note: this exludes IAM actions, so combine with IAMFullAccess if rotation configuration is required.

Operator and limited (84)

IAM (10)

Multi-service (10)

  • AmazonSumerianFullAccessNo privilege tier

    Provides full access to Amazon Sumerian.

  • AWSCompromisedKeyQuarantineNo privilege tier

    Denies access to certain actions, applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly. Do NOT remove this policy. Instead, please follow the instructions specified in the email sent …

  • AWSCompromisedKeyQuarantineV2No privilege tier

    Denies access to certain actions, applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly. Do NOT remove this policy. Instead, please follow the instructions specified in the support cas…

  • AWSCompromisedKeyQuarantineV3No privilege tier

    Denies access to certain actions, applied by AWS in the event that an IAM user's credentials have been compromised or exposed publicly. The policy aims to limit the potential damage that may be caused by fraud-related activity leading to un…

  • AWSCompromisedKeyQuarantineV4No privilege tier

    Denies access to certain actions, applied by AWS in the event that an IAM user's credentials have been compromised or exposed publicly. The policy aims to limit the potential damage that may be caused by fraud-related activity leading to un…

  • AWSDeepRacerDefaultMultiUserAccessNo privilege tier

    DeepRacer MultiUser Default user access to use deepracer in multi-user mode

  • AWSDenyAllNo privilege tier

    Deny all access.

  • AWSIotRoboRunnerReadOnlyNo privilege tier

    This policy grants permissions that allow read-only access to AWS Iot RoboRunner.

  • ReadOnlyAccessOperator

    Provides read-only access to AWS services and resources.

  • SecurityAuditOperator

    The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.

Private CA (5)

Account (4)

IAM Identity Center (4)

IoT (4)

Certificate Manager (3)

Cognito (3)

SageMaker (3)

  • AmazonDataZoneSageMakerProvisioningRolePolicyOperator

    The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.

  • AmazonSageMakerHyperPodInferenceGatewayAccessOperator

    This policy provides the permissions required to set up and operate the SageMaker HyperPod inference gateway. It enables the gateway to manage AWS Certificate Manager (ACM) certificates for TLS termination when deploying and serving inferen…

  • AmazonSageMakerSpacesRouterPolicyOperator

    Grants Systems KMS key operations permissions required for the SageMaker Spaces Router to enable secure remote access to EKS SageMaker Spaces.

Secrets Manager (3)

  • AWSQuickSightSecretsManagerWritePolicyOperator

    Policy used by QuickSight to create secrets in AWS Secrets Manager and to attach resource policies on existing QuickSight secrets.

  • AWSSecretsManagerClientReadOnlyAccessOperator

    Provides access to retrieve and describe secrets from Secrets Manager. This policy also allows decrypting KMS keys for Secrets Manager secrets.

  • AWSTransformSecretsManagerConnectorPolicyOperator

    Enables the AWS Transform service to read a specified SecretsManager Secret in connection to specified KMS key. This policy grants permissions to read the specified secret value and decrypt it is the secret is encrypted

Systems Manager (3)

  • AmazonSSMDirectoryServiceAccessOperator

    This policy allows SSM Agent to access Directory Service on behalf of the customer for domain-join the managed instance.

  • AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator

    Quick Setup creates IAM roles which enable it to configure the Host Manager Quick Setup type on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSQuickSetupSSMManageResourcesExecutionPolicyOperator

    This policy grants permissions that allow Systems Manager to create prerequisites such as IAM roles required for Systems Manager onboarding.

Artifact (2)

  • AWSArtifactAgreementsFullAccessOperator

    This policy grants full permissions to list, download, accept, and terminate AWS Artifact agreements. It also includes permissions to list and enable AWS service access in the Organization service, as well as describe the organization detai…

  • AWSArtifactComplianceInquiriesFullAccessOperator

    Provides full access to the Artifact Compliance Inquiry.

Bio Discovery (2)

CloudWatch (2)

DataZone (2)

Detective (2)

  • AmazonDetectiveInvestigatorAccessOperator

    Provides investigator access to Amazon Detective service and scoped access to the console UI dependencies. This policy grants permission to dive into Detective for investigation purposes and limited write access to Guardduty.

  • AmazonDetectiveMemberAccessOperator

    Provides member access to Amazon Detective service and scoped access to the console UI dependencies.

Directory Service (2)

securityagent (2)

  • AWSSecurityAgentContinuousPentestPolicyOperator

    Grants the permissions required to run AWS Security Agent continuous scoped penetration tests from a CI/CD pipeline. Attached to a customer-created IAM role that a 3P CI/CD pipeline assumes via OIDC

  • SecurityAgentWebAppPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

WAF, Firewall Manager and Shield (2)

  • AWSWAFConsoleFullAccessOperator

    Provides full access to AWS WAF via the AWS Management Console. Note that this policy also grants permissions to list and update Amazon CloudFront distributions, permissions to view load balancers on AWS Elastic Load Balancing, permissions …

  • AWSWAFFullAccessOperator

    Provides full access to AWS WAF actions.

Other services (16)

  • AmazonInspector2ManagedCisPolicyOperator

    This is a managed policy that customer should attach to their roles to communicate with inspector service for CIS scans

  • AmazonOpenSearchServiceCognitoAccessOperator

    Provides access to the Amazon Cognito configuration service.

  • AmazonVerifiedPermissionsFullAccessOperator

    Provides full access to Verified Permissions

  • AWSBackupServiceRolePolicyForScansOperator

    Provides AWS Backup permission to perform malware scans on your AWS Backup Recovery Points

  • AWSIdentitySyncFullAccessOperator

    Grants full access to the Identity Sync service

  • AWSKeyManagementServicePowerUserOperator

    Provides access to AWS Key Management Service (KMS).

  • AWSLakeFormationCrossAccountManagerOperator

    Provides cross account access to Glue resources via Lake Formation. Also grants read access to other required services such as organizations and resource access manager

  • AWSNetworkFirewallFullAccessOperator

    Grants full access to AWS Network Firewall service, including permissions to create, configure, manage, and delete firewall resources, policies, and rule groups. Additionally includes permissions to modify VPC endpoints, S3 bucket policies,…

  • AWSResourceAccessManagerResourceShareParticipantAccessOperator

    Provides access to AWS Resource Access Manager APIs needed by a resource share participant.

  • AWSRolesAnywhereFullAccessOperator

    Provides all permissions to IAM Roles Anywhere resources, including but not limited to: CreateProfile, DeleteTrustAnchor, DisableCRL, ResetNotificationSettings.

  • AWSSecurityIncidentResponseCaseFullAccessOperator

    Policy provides customers with Read and Write permissions to case resources that are created through the Security Incident Response service.

  • AWSTransformSecurityAgentExecutorAccessOperator

    Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.

  • AWSVendorInsightsAssessorFullAccessOperator

    Provides full access for viewing entitled Vendor Insights resources and managing Vendor Insights subscriptions

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • MultiPartyApprovalReadOnlyAccessOperator

    Provides read-only access to Multi-party approval. This policy also includes related read permission to AWS Organizations and AWS IAM Identity for approval teams and identity sources.

  • ResourceGroupsTaggingAPITagUntagSupportedResourcesOperator

    Provides permissions to tag and untag all the resources supported by Resource Groups Tagging API. This policy also grants the permissions required to retrieve all tagged, or previously tagged, resources through the Resource Groups Tagging A…

Service roles (22)

SageMaker (5)

  • SageMakerStudioBedrockFunctionExecutionRolePolicyOperator

    Allows AWS Lambda to access an Amazon Bedrock function component's configuration in SageMaker Studio.

  • SageMakerStudioDomainServiceRolePolicyOperator

    Service role for domain level actions in the portal that are performed by Amazon SageMaker Studio.

  • SageMakerStudioEMRContainersSystemNamespaceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SageMakerStudioEMRInstanceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SageMakerStudioEMRServiceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

IAM Identity Center (2)

IoT (2)

RDS (2)

securityagent (2)

  • AWSSecurityAgentWebAppPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

  • SecurityAgentWebAppAPIPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

Other services (9)

Service-linked roles (42)

IAM (6)

CloudWatch (2)

  • AWSCloudWatchOmniServiceRolePolicyOperator

    Provides CloudWatch Omni access to manage AWS Config recorder resources, telemetry configurations, and supporting IAM roles for organization enablement.

  • CloudWatch-CrossAccountAccessOperator

    Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross-region

KMS (2)

Marketplace (2)

Private CA (2)

Secrets Manager (2)

Security Incident Response (2)

Other services (24)

Also relevant to Security, Identity & Compliance (232)
IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.