Security, Identity & Compliance: Reader policies
Identity, access, encryption, threat detection and compliance.
41 AWS managed policies. 6 have reviewed guidance; the rest have authoritative permission data pending editorial review. 6 are service-linked role policies, shown with permission data only.
User access (33)
Inspector (2)
- AmazonInspector2ReadOnlyAccessReader
Provides read only access to the Amazon inspector2 service and relevant support services
- AmazonInspectorReadOnlyAccessReader
Provides read only access to Amazon Inspector.
WAF, Firewall Manager and Shield (3)
- AWSFMAdminReadOnlyAccessReader
Read only access for AWS FM Administrator that allows monitoring AWS FM operations
- AWSFMMemberReadOnlyAccessReader
Provides read only access to AWS WAF actions for AWS Firewall Manager member accounts
- AWSWAFReadOnlyAccessReader
Provides read only access to AWS WAF actions.
Certificate Manager (2)
- AWSCertificateManagerPrivateCAReadOnlyReader
Provides read only access to AWS Certificate Manager Private Certificate Authority
- AWSCertificateManagerReadOnlyReader
Provides read only access to AWS Certificate Manager (ACM).
IAM (3)
- IAMAccessAdvisorReadOnlyReader
This policy grants access to read all access information provided by IAM access advisor such as service last accessed information.
- IAMAccessAnalyzerReadOnlyAccessReader
Provides read only access to IAM Access Analyzer resources
- IAMReadOnlyAccessReader
Provides read only access to IAM via the AWS Management Console.
Artifact (3)
- AWSArtifactAgreementsReadOnlyAccessReader
This policy grants read-only access to list the AWS Artifact service agreements and to download the accepted agreements.. It also includes permissions to list as well as describe the organization details. Additionally, the policy provides t…
- AWSArtifactComplianceInquiriesReadOnlyAccessReader
Provides read-only access to Artifact Compliance Inquiry.
- AWSArtifactReportsReadOnlyAccessReader
Provides read-only access to the AWS Artifact service reports.
Directory Service (1)
- AWSDirectoryServiceReadOnlyAccessReader
Provides read only access to AWS Directory Service.
GuardDuty (1)
- AmazonGuardDutyReadOnlyAccessReader
Provides read only access to Amazon GuardDuty resources
Vendor Insights (2)
- AWSVendorInsightsAssessorReadOnlyReader
Provides read-only access for viewing entitled Vendor Insights resources
- AWSVendorInsightsVendorReadOnlyReader
Provides read-only access for viewing the Vendor Insights resources
Cloud Directory (1)
- AmazonCloudDirectoryReadOnlyAccessReader
Provides read only access to Amazon Cloud Directory Service.
CloudHSM (1)
- AWSCloudHSMReadOnlyAccessReader
Provides read only access to all CloudHSM resources.
IAM Identity Center (1)
- AWSManagedSettingsReadOnlyAccessReader
Grants team members read-only access to AWS Settings, including workspace and owner information, team membership, plan and spend summary. It does not grant permissions to modify workspace configuration or to manage billing and payments.
Macie (1)
- AmazonMacieReadOnlyAccessReader
Provides readonly access to Amazon Macie.
Network Firewall (2)
- AmazonVPCReachabilityAnalyzerPathComponentReadPolicyReader
This policy is attached to the role IAMRoleForReachabilityAnalyzerCrossAccountResourceAccess. This role is deployed to the member accounts in an organization when the management account enables trusted access for Reachability Analyzer. It p…
- AWSNetworkFirewallReadOnlyAccessReader
Provides read-only access to AWS Network Firewall resources via the AWS Management Console, CLI, and SDKs. This policy allows users to view and monitor firewall configurations, policies, rule groups, and associated resources, without the ab…
Private CA (1)
- AWSPrivateCAReadOnlyReader
Provides read only access to AWS Private Certificate Authority
Resource Access Manager (1)
- AWSResourceAccessManagerReadOnlyAccessReader
Provides read only access to AWS Resource Access Manager.
Security Incident Response (1)
- AWSSecurityIncidentResponseReadOnlyAccessReader
Policy provides customers with Read-only permissions to all resources associated to the Security Incident Response service. Permission includes access to GetCaseAttachmentDownloadUrl as well for the ability to get case attachment download U…
SecurityHub (1)
- AWSSecurityHubReadOnlyAccessReader
Provides read only access to AWS Security Hub resources
Signin (2)
- AWSMCPSignInOAuthAccessPolicyReader
Provides access to authenticate to the AWS MCP server using AWS Sign-In OAuth
- SignInLocalDevelopmentAccessReader
Provides permissions for programmatic access to AWS through the AWS Sign-in service, including OAuth2 token creation for developer tools and applications.
Other services (4)
- AmazonVerifiedPermissionsReadOnlyAccessReader
Provides read-only access to the Verified Permissions service.
- AWSIdentitySyncReadOnlyAccessReader
Read only access to the Identity Sync service
- AWSRolesAnywhereReadOnlyReader
Provides read-only permissions to IAM Roles Anywhere resources, including but not limited to: GetTrustAnchor, ListProfiles, GetCRL. There will be no other permissions for other services included in this policy.
- FinOpsAgentIdentityReaderPolicyReader
Provides permissions required by AWS FinOps Agent to read IAM Identity Center user and group information and check group membership for agent access
Service roles (2)
Other services (2)
- AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicyReader
Service role policy used by the AWS Lambda within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Secrets Manager and others.
- AWSQuickSightListIAMReader
Allow QuickSight to list IAM entities
Service-linked roles (6)
IAM (3)
- AccessAnalyzerServiceRolePolicyReader
Allow Access Analyzer to analyze resource metadata
- AWSManagedServices_ContactsServiceRolePolicyReader
Allows AWS Managed Services to read the values of the tags on AWS resources
- AWSUserAttributeCostAllocationPolicyReader
Provides read-only access to user attributes from AWS IAM Identity Center for the user attributes that the customer has opted in to.
Other services (3)
- AmazonHoneycodeServiceRolePolicyReader
A service-linked role required for Amazon Honeycode to access your resources.
- AWSDirectConnectServiceRolePolicyReader
Provides AWS Direct Connect permission to create and manage AWS resources on your behalf.
- AWSSystemsManagerNotificationsServicePolicyReader
Permissions required to collect information about a user for Just-In-Time-Node-Access notifications.
Also relevant to Security, Identity & Compliance (14)
- AIOpsReadOnlyAccessReader
Grants ReadOnly permissions to the Amazon AI Operations service and its required resources.
- AmazonCodeGuruProfilerReadOnlyAccessReader
Provides read only access to Amazon CodeGuru Profiler.
- AmazonDocDBReadOnlyAccessReader
Provides read-only access to Amazon DocumentDB with MongoDB compatibility. Note that this policy also grants access to Amazon RDS and Amazon Neptune resources.
- AmazonElasticContainerRegistryPublicReadOnlyReader
Provides read-only access to Amazon ECR Public repositories.
- AmazonKeyspacesReadOnlyAccessReader
Provide read only access to Amazon Keyspaces
- AmazonKeyspacesReadOnlyAccess_v2Reader
Provide read only access to Amazon Keyspaces and related AWS services.
- AmazonKinesisAnalyticsReadOnlyReader
Provides read-only access to Amazon Kinesis Analytics via the AWS Management Console.
- AmazonNimbleStudio-LaunchProfileWorkerReader
This policy grants access to resources needed by Nimble Studio Launch Profile workers. Attach this policy to EC2 instances created by Nimble Studio Builder.
- AmazonZocaloReadOnlyAccessReader
Provides read only access to Amazon Zocalo
- AWSAppMeshPreviewServiceRolePolicyReader
Enables access to AWS services and Resources used or managed by AWS App Mesh
- AWSAppMeshReadOnlyReader
Provides read-only access to the AWS App Mesh APIs and Management Console.
- AWSAppMeshServiceRolePolicyReader
Enables access to AWS services and Resources used or managed by AWS AppMesh
- AWSIoTDeviceDefenderAuditReader
Provides read access for IoT and related resources
- AWSMigrationHubOrchestratorInstanceRolePolicyReader
This policy needs to be attached for SAP and MGN migrated instance for our service to orchestrate instances by downloading scripts from S3 and to fetch secret values inside EC2 instance.