Skip to main content
IAM Policy Map

Security, Identity & Compliance: Operator policies

Identity, access, encryption, threat detection and compliance.

122 AWS managed policies. 10 have reviewed guidance; the rest have authoritative permission data pending editorial review. 36 are service-linked role policies, shown with permission data only.

Operator and limited (68)

IAM (9)

Multi-service (2)

  • ReadOnlyAccessOperator

    Provides read-only access to AWS services and resources.

  • SecurityAuditOperator

    The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account.

Private CA (5)

Account (3)

IAM Identity Center (4)

Certificate Manager (3)

Cognito (3)

SageMaker (3)

  • AmazonDataZoneSageMakerProvisioningRolePolicyOperator

    The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone the permissions required to interoperate with Amazon SageMaker.

  • AmazonSageMakerHyperPodInferenceGatewayAccessOperator

    This policy provides the permissions required to set up and operate the SageMaker HyperPod inference gateway. It enables the gateway to manage AWS Certificate Manager (ACM) certificates for TLS termination when deploying and serving inferen…

  • AmazonSageMakerSpacesRouterPolicyOperator

    Grants Systems KMS key operations permissions required for the SageMaker Spaces Router to enable secure remote access to EKS SageMaker Spaces.

Secrets Manager (3)

  • AWSQuickSightSecretsManagerWritePolicyOperator

    Policy used by QuickSight to create secrets in AWS Secrets Manager and to attach resource policies on existing QuickSight secrets.

  • AWSSecretsManagerClientReadOnlyAccessOperator

    Provides access to retrieve and describe secrets from Secrets Manager. This policy also allows decrypting KMS keys for Secrets Manager secrets.

  • AWSTransformSecretsManagerConnectorPolicyOperator

    Enables the AWS Transform service to read a specified SecretsManager Secret in connection to specified KMS key. This policy grants permissions to read the specified secret value and decrypt it is the secret is encrypted

Systems Manager (3)

  • AmazonSSMDirectoryServiceAccessOperator

    This policy allows SSM Agent to access Directory Service on behalf of the customer for domain-join the managed instance.

  • AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator

    Quick Setup creates IAM roles which enable it to configure the Host Manager Quick Setup type on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • AWSQuickSetupSSMManageResourcesExecutionPolicyOperator

    This policy grants permissions that allow Systems Manager to create prerequisites such as IAM roles required for Systems Manager onboarding.

Artifact (2)

  • AWSArtifactAgreementsFullAccessOperator

    This policy grants full permissions to list, download, accept, and terminate AWS Artifact agreements. It also includes permissions to list and enable AWS service access in the Organization service, as well as describe the organization detai…

  • AWSArtifactComplianceInquiriesFullAccessOperator

    Provides full access to the Artifact Compliance Inquiry.

Bio Discovery (2)

CloudWatch (1)

DataZone (1)

  • AmazonDataZonePreviewConsoleFullAccessOperator

    Provides full access to the Preview release of Amazon DataZone via the AWS Management Console. Also provides select access to other related services.

Detective (2)

  • AmazonDetectiveInvestigatorAccessOperator

    Provides investigator access to Amazon Detective service and scoped access to the console UI dependencies. This policy grants permission to dive into Detective for investigation purposes and limited write access to Guardduty.

  • AmazonDetectiveMemberAccessOperator

    Provides member access to Amazon Detective service and scoped access to the console UI dependencies.

Directory Service (2)

securityagent (2)

  • AWSSecurityAgentContinuousPentestPolicyOperator

    Grants the permissions required to run AWS Security Agent continuous scoped penetration tests from a CI/CD pipeline. Attached to a customer-created IAM role that a 3P CI/CD pipeline assumes via OIDC

  • SecurityAgentWebAppPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

WAF, Firewall Manager and Shield (2)

  • AWSWAFConsoleFullAccessOperator

    Provides full access to AWS WAF via the AWS Management Console. Note that this policy also grants permissions to list and update Amazon CloudFront distributions, permissions to view load balancers on AWS Elastic Load Balancing, permissions …

  • AWSWAFFullAccessOperator

    Provides full access to AWS WAF actions.

Other services (16)

  • AmazonInspector2ManagedCisPolicyOperator

    This is a managed policy that customer should attach to their roles to communicate with inspector service for CIS scans

  • AmazonOpenSearchServiceCognitoAccessOperator

    Provides access to the Amazon Cognito configuration service.

  • AmazonVerifiedPermissionsFullAccessOperator

    Provides full access to Verified Permissions

  • AWSBackupServiceRolePolicyForScansOperator

    Provides AWS Backup permission to perform malware scans on your AWS Backup Recovery Points

  • AWSIdentitySyncFullAccessOperator

    Grants full access to the Identity Sync service

  • AWSKeyManagementServicePowerUserOperator

    Provides access to AWS Key Management Service (KMS).

  • AWSLakeFormationCrossAccountManagerOperator

    Provides cross account access to Glue resources via Lake Formation. Also grants read access to other required services such as organizations and resource access manager

  • AWSNetworkFirewallFullAccessOperator

    Grants full access to AWS Network Firewall service, including permissions to create, configure, manage, and delete firewall resources, policies, and rule groups. Additionally includes permissions to modify VPC endpoints, S3 bucket policies,…

  • AWSResourceAccessManagerResourceShareParticipantAccessOperator

    Provides access to AWS Resource Access Manager APIs needed by a resource share participant.

  • AWSRolesAnywhereFullAccessOperator

    Provides all permissions to IAM Roles Anywhere resources, including but not limited to: CreateProfile, DeleteTrustAnchor, DisableCRL, ResetNotificationSettings.

  • AWSSecurityIncidentResponseCaseFullAccessOperator

    Policy provides customers with Read and Write permissions to case resources that are created through the Security Incident Response service.

  • AWSTransformSecurityAgentExecutorAccessOperator

    Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.

  • AWSVendorInsightsAssessorFullAccessOperator

    Provides full access for viewing entitled Vendor Insights resources and managing Vendor Insights subscriptions

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • MultiPartyApprovalReadOnlyAccessOperator

    Provides read-only access to Multi-party approval. This policy also includes related read permission to AWS Organizations and AWS IAM Identity for approval teams and identity sources.

  • ResourceGroupsTaggingAPITagUntagSupportedResourcesOperator

    Provides permissions to tag and untag all the resources supported by Resource Groups Tagging API. This policy also grants the permissions required to retrieve all tagged, or previously tagged, resources through the Resource Groups Tagging A…

Service roles (18)

SageMaker (5)

  • SageMakerStudioBedrockFunctionExecutionRolePolicyOperator

    Allows AWS Lambda to access an Amazon Bedrock function component's configuration in SageMaker Studio.

  • SageMakerStudioDomainServiceRolePolicyOperator

    Service role for domain level actions in the portal that are performed by Amazon SageMaker Studio.

  • SageMakerStudioEMRContainersSystemNamespaceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SageMakerStudioEMRInstanceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SageMakerStudioEMRServiceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

IAM Identity Center (2)

IoT (2)

RDS (1)

  • AmazonRDSDirectoryServiceAccessOperator

    Allow RDS to access Directory Service Managed AD on behalf of the customer for domain-joined SQL Server DB instances.

securityagent (2)

  • AWSSecurityAgentWebAppPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

  • SecurityAgentWebAppAPIPolicyOperator

    Provides permissions for authenticated users to access the Security Agent Web Application for configuring and executing automated security penetration tests. This policy enables users to manage pentests, view findings, monitor test executio…

Other services (6)

Service-linked roles (36)

IAM (3)

CloudWatch (2)

  • AWSCloudWatchOmniServiceRolePolicyOperator

    Provides CloudWatch Omni access to manage AWS Config recorder resources, telemetry configurations, and supporting IAM roles for organization enablement.

  • CloudWatch-CrossAccountAccessOperator

    Allows CloudWatch to assume CloudWatch-CrossAccountSharing roles in remote accounts on behalf of the current account in order to display data cross-account, cross-region

KMS (2)

Marketplace (2)

Private CA (2)

Secrets Manager (2)

Security Incident Response (2)

Other services (21)

Also relevant to Security, Identity & Compliance (188)
IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.