Security, Identity & Compliance: Admin policies
Identity, access, encryption, threat detection and compliance.
28 AWS managed policies. 5 have reviewed guidance; the rest have authoritative permission data pending editorial review.
User access (27)
Inspector (4)
- AmazonInspector2FullAccessAdmin
Provides full access to Amazon Inspector and access to other related services such as organizations.
- AmazonInspector2FullAccess_v2Admin
Provides full access to Amazon Inspector and access to other related services such as organizations with restrictive organizational access.
- AmazonInspector2ManagedTelemetryPolicyAdmin
Grants permissions to communicate with Inspector2 Telemetry Channel
- AmazonInspectorFullAccessAdmin
Provides full access to Amazon Inspector.
WAF, Firewall Manager and Shield (1)
- AWSFMAdminFullAccessAdmin
Full access for AWS FM Administrator
Certificate Manager (2)
- AWSCertificateManagerFullAccessAdmin
Provides full access to AWS Certificate Manager (ACM)
- AWSCertificateManagerPrivateCAFullAccessAdmin
Provides full access to AWS Certificate Manager Private Certificate Authority
IAM (1)
- IAMAccessAnalyzerFullAccessAdmin
Provides full access to IAM Access Analyzer
Directory Service (2)
- AmazonZocaloFullAccessAdmin
Provides full access to Amazon Zocalo.
- AWSDirectoryServiceFullAccessAdmin
Provides full access to AWS Directory Service.
GuardDuty (2)
- AmazonGuardDutyFullAccessAdmin
Provides full access to use Amazon GuardDuty.
- AmazonGuardDutyFullAccess_v2Admin
Provides full access to use Amazon GuardDuty
Vendor Insights (1)
- AWSVendorInsightsVendorFullAccessAdmin
Provides full access for creating and managing the Vendor Insights resources
Cloud Directory (1)
- AmazonCloudDirectoryFullAccessAdmin
Provides full access to Amazon Cloud Directory Service.
CloudHSM (1)
- AWSCloudHSMFullAccessAdmin
Provides full access to all CloudHSM resources.
IAM Identity Center (1)
- AWSSSODirectoryAdministratorAdmin
Administrator access for SSO Directory
Macie (1)
- AmazonMacieFullAccessAdmin
Provides full access to Amazon Macie.
Private CA (1)
- AWSPrivateCAFullAccessAdmin
Provides full access to AWS Private Certificate Authority
Resource Access Manager (1)
- AWSResourceAccessManagerFullAccessAdmin
Provides full access to AWS Resource Access Manager
Security Incident Response (1)
- AWSSecurityIncidentResponseFullAccessAdmin
Policy provides customers with Read and Write permissions to all resources associated to the Security Incident Response service.
SecurityHub (1)
- AWSSecurityHubFullAccessAdmin
Provides full access to use AWS Security Hub.
Other services (6)
- AmazonCognitoPowerUserAdmin
Provides administrative access to existing Amazon Cognito resources. You will need AWS account admin privileges to create new Cognito resources.
- AmazonDetectiveFullAccessAdmin
Provides full access to Amazon Detective service and scoped access to the console UI dependencies
- AWSAuditManagerAdministratorAccessAdmin
Provides administrative access to enable or disable AWS Audit Manager, update settings, and manage assessments, controls, and frameworks
- AWSManagedSettingsAdminAccessAdmin
Grants full administrative access to AWS account settings management. This policy allows owners to view and modify account information, billing, payments, tax registration, identity management, organization policies, budgets, cost analysis,…
- MultiPartyApprovalFullAccessAdmin
Provides full access to Multi-party approval. This policy also includes related permissions to AWS Organizations and AWS IAM Identity for managing approval teams and identity sources.
- SecretsManagerReadWriteAdmin
Provides read/write access to AWS Secrets Manager via the AWS Management Console. Note: this exludes IAM actions, so combine with IAMFullAccess if rotation configuration is required.
Service roles (1)
Other services (1)
- AWSShieldDRTAccessPolicyAdmin
Provides the AWS DDoS Response Team with limited access to your AWS account to assist with DDoS attack mitigation during a high-severity event.
Also relevant to Security, Identity & Compliance (29)
- AdministratorAccessHigh privilegeAdmin
Provides full access to AWS services and resources.
- AdministratorAccess-AmplifyHigh privilegeAdmin
Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications.
- AIOpsConsoleAdminPolicyAdmin
Grants full access to Amazon AI Operations service and its required permissions via AWS console. It also includes permissions to use identity-aware console sessions.
- AmazonAppFlowFullAccessAdmin
Provides full access to Amazon AppFlow and access to AWS services supported as flow source or destination (S3 and Redshift). Also provides access to KMS for encryption
- AmazonAuroraDSQLConsoleFullAccessAdmin
Provides console full administrative access to Aurora DSQL
- AmazonAuroraDSQLFullAccessAdmin
Provides full administrative access to Aurora DSQL
- AmazonCloudWatchRUMFullAccessAdmin
Grants full access permissions for the Amazon CloudWatch RUM service
- AmazonCodeGuruProfilerFullAccessAdmin
Provides full access to Amazon CodeGuru Profiler.
- AmazonDocDBElasticFullAccessAdmin
Provides full access to Amazon DocumentDB Elastic Clusters and other required permissions for its dependencies including EC2, KMS, SecretsManager, CloudWatch and IAM.
- AmazonKendraFullAccessAdmin
Provides full access to Amazon Kendra via the AWS Management Console.
- AmazonLaunchWizard_FullaccessAdmin
Full access to AWS Launch wizard and other required services.
- AmazonLaunchWizardFullAccessV2Admin
Full access to AWS Launch wizard and other required services.
- AmazonMonitronFullAccessAdmin
Provides full access to manage Amazon Monitron
- AmazonQuickSuiteAccessPolicyAdmin
Provides permissions for Amazon Quick Suite to manage its IAM Identity Center application, identity store users and groups, user subscriptions, and QuickSight resources on your behalf.
- AmazonRDSDataFullAccessHigh privilegeAdmin
Allows full access to use the RDS data APIs, secret store APIs for RDS database credentials, and DB console query management APIs to execute SQL statements on Aurora Serverless clusters in the AWS account.
- AmazonSecurityLakeAdministratorAdmin
Provides full access to Amazon Security Lake and related services needed to administer Security Lake.
- AWSBudgetsActionsWithAWSResourceControlAccessAdmin
Provides full access to AWS Budgets Actions including using Budgets Actions to control states of running AWS resources via AWS Management Console
- AWSCODAPermissionsBoundaryHigh privilegeAdmin
AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.
- AWSDataPipeline_PowerUserAdmin
Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles.
- AWSDataSyncFullAccessAdmin
Provides full access to AWS DataSync and minimal access to its dependencies
- AwsGlueDataBrewFullAccessPolicyAdmin
Provides full access to AWS Glue DataBrew via the AWS Management Console. Also provides select access to related services (e.g., S3, KMS, Glue).
- AWSGrafanaAccountAdministratorAdmin
Provides access within Amazon Grafana to create and manage workspaces for the entire organization.
- AWSMigrationHubOrchestratorConsoleFullAccessAdmin
Provides limited access to AWS Migration Hub, AWS Application Discovery Service, Amazon Simple Storage Service and AWS Secrets Manager. This policy also grants full access to AWS Migration Hub Orchestrator service.
- AWSSSOMasterAccountAdministratorHigh privilegeAdmin
Provides access within AWS SSO to manage AWS Organizations master and member accounts and cloud application
- AWSSSOMemberAccountAdministratorHigh privilegeAdmin
Provides access within AWS SSO to manage AWS Organizations member accounts and cloud application
- AWSSupportPlansFullAccessAdmin
Provides full access to supportplans.
- IAMFullAccessHigh privilegeAdmin
Provides full access to IAM via the AWS Management Console.
- PowerUserAccessHigh privilegeAdmin
Provides full access to AWS services and resources, but does not allow management of Users and groups.
- SupportUserAdmin
This policy grants permissions to troubleshoot and resolve issues in an AWS account. This policy also enables the user to contact AWS support to create and manage cases.