Serverless: Switch between the hub and domains
Serverless policies
Function-based compute and serverless application packaging.
15 AWS managed policies. 2 have reviewed guidance; the rest have authoritative permission data pending editorial review. 5 are service-linked role policies, shown with permission data only.
Loading map…
Loading map
User access (2)
- AWSLambda_FullAccessAdmin
Grants full access to AWS Lambda service, AWS Lambda console features, and other related AWS services.
- AWSLambda_ReadOnlyAccessAnalyst
Grants read-only access to AWS Lambda service, AWS Lambda console features, and other related AWS services.
Operator and limited (2)
- AWSLambdaInvokeWebFunctionEndpointAccessOperator
Grants permission to invoke AWS Lambda Web function endpoints.
- AWSThinkboxDeadlineResourceTrackerAdminPolicyOperator
Grants permissions required to create, destroy, and administer AWS Thinkbox's Deadline Resource Tracker.
Service roles (6)
- AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicyOperator
Service role policy used by the AWS APIGateway within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Lambda and others.
- AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicyOperator
Service role policy used by the AWS CloudFormation within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including Lambda, APIGateway and others.
- AWSCodeDeployRoleForCloudFormationOperator
Provides CodeDeploy service access to invoke Lambda function on your behalf to perform blue/green deployment through CloudFormation.
- AWSCodeDeployRoleForLambdaOperator
Provides CodeDeploy service access to perform a Lambda deployment on your behalf.
- AWSCodeDeployRoleForLambdaLimitedOperator
Provides CodeDeploy service limited access to perform a Lambda deployment on your behalf.
- AWSLambdaRoleOperator
Default policy for AWS Lambda service role.
Service-linked roles (5)
- AWSApplicationAutoscalingLambdaConcurrencyPolicyOperator
Policy granting permissions to Application Auto Scaling to access Lambda and CloudWatch.
- AWSContinuumCollectorServiceRolePolicyOperator
Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.
- AWSLambdaReplicatorOperator
Grants Lambda Replicator necessary permissions to replicate functions across regions
- ClientVPNServiceConnectionsRolePolicyOperator
Policy to enable AWS Client VPN to manage your Client VPN endpoint connections.
- SecurityLakeResourceManagementServiceRolePolicyOperator
Provides access to manage resources created by Security Lake.
Also relevant to Serverless (16)
- AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin
This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…
- AmazonSageMakerPipelinesIntegrationsOperator
This Amazon Managed Policy grants permissions commonly needed for use with Callback steps and Lambda steps in SageMaker Model Building Pipelines. It is added to the AmazonSageMaker-ExecutionRole that can be created when setting up SageMaker…
- AmplifyBackendDeployFullAccessOperator
Provides Amplify full access permissions to deploy Amplify backend resources (AWS AppSync, Amazon Cognito, Amazon S3 and other related services) via the AWS Cloud Development Kit (AWS CDK)
- AWSBudgetsSpendLimitMemberRolePolicyOperator
Grants the AWS Budgets service permissions to describe, stop, and terminate resources in a member account to enforce spend limit actions.
- AWSLambdaBasicDurableExecutionRolePolicyOperator
Provides write permissions to CloudWatch Logs and read/write permissions to durable execution APIs used by Lambda durable functions
- AWSLambdaFullAccessHigh privilegeAdmin
This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.
- AWSLambdaInvocation-DynamoDBOperator
Provides read access to DynamoDB Streams.
- AWSQuickSetupSSMDeploymentRolePolicyOperator
This policy grants administrative permssions that allow Quick Setup to create resources that are used during the Systems Manager onboarding process.
- AWSRoboMakerServicePolicyOperator
RoboMaker service policy
- AWSRoboMakerServiceRolePolicyOperator
RoboMaker service policy
- CloudWatchAutomaticDashboardsAccessReader
Provides access to the non-CloudWatch APIs used to display CloudWatch Automatic Dashboards, including the contents of objects such as Lambda functions
- CloudWatchSyntheticsFullAccessAdmin
Provides full access to CloudWatch Synthetics.
- Route53RecoveryReadinessServiceRolePolicyOperator
Service Linked Role Policy for Route 53 Recovery Readiness
- SageMakerStudioBedrockFlowServiceRolePolicyOperator
Allows Amazon Bedrock Flows to access Amazon Bedrock models and other resources attached to a flow in SageMaker Studio.
- SageMakerStudioQueryExecutionRolePolicyOperator
Amazon SageMaker Studio uses this policy when running query executions on federated connections.
- SecretsManagerReadWriteAdmin
Provides read/write access to AWS Secrets Manager via the AWS Management Console. Note: this exludes IAM actions, so combine with IAMFullAccess if rotation configuration is required.