Skip to main content
IAM Policy Map
IAM Policy Map
Storage: Switch between the hub and domains
MapList

Can change permissions or pass roles: 12 of 96 policies: 0 unrestricted, 12 scoped or conditional. These grants let a principal change who has access, or hand a role to a service. AWS advises restricting them, and notes that passing any role can lead to unintended privilege escalation.

Data access: 62 of 96 policies: 36 write, 22 read only, 4 list only. Counts policies that grant actions AWS marks as operating on data held in a resource. Some granted actions are not yet classified by AWS.

Storage policies

Object, block, file and archive storage, plus backup.

96 AWS managed policies. 9 have reviewed guidance; the rest have authoritative permission data pending editorial review. 11 are service-linked role policies, shown with permission data only.

Loading map…

Loading map

User access (27)

S3 (7)

FSx (4)

EFS (3)

S3 Files (3)

Glacier (2)

S3 Outposts (2)

Storage Gateway (2)

Other services (4)

  • AmazonSecurityLakeAdministratorAdmin

    Provides full access to Amazon Security Lake and related services needed to administer Security Lake.

  • AWSBackupFullAccessAdmin

    This policy is for backup administrators, granting full access to AWS Backup operations, including creating or editing backup plans, assigning AWS resources to backup plans, deleting backups, and restoring backups.

  • AWSMigrationHubOrchestratorInstanceRolePolicyReader

    This policy needs to be attached for SAP and MGN migrated instance for our service to orchestrate instances by downloading scripts from S3 and to fetch secret values inside EC2 instance.

  • ConsoleViewOnlyAccessFromVercelReader

    For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to view all resources for the services that are integrated with the Vercel Marketplace.

Operator and limited (35)

Backup (9)

  • AWSBackupAccessPointOperatorAccessOperator

    This policy grants users permissions to create and manage backup access points for accessing backup data in recovery points through S3 access points.

  • AWSBackupAuditAccessOperator

    This policy grants permissions for users to create controls and frameworks that define their expectations for AWS Backup resources and activities, and to audit AWS Backup resources and activities against their defined controls and framework…

  • AWSBackupDataTransferAccessOperator

    This policy allows the AWS Backint agent to complete backup data transfer with AWS Backup Storage plane. Attach this policy to roles assumed by EC2 Instances running SAP HANA with the Backint agent.

  • AWSBackupOperatorAccessOperator

    This policy grants users permissions to assign AWS resources to backup plans, create on-demand backups, and restore backups. This policy does not allow the user to create or edit backup plans or to delete scheduled backups after they are cr…

  • AWSBackupRestoreAccessForSAPHANAOperator

    Provides AWS Backup permission to restore a backup of SAP HANA on Amazon EC2

  • AWSBackupServiceRolePolicyForIndexingOperator

    Policy containing permissions necessary for AWS Backup to index recovery points.

  • AWSBackupServiceRolePolicyForItemRestoresOperator

    Policy containing permissions necessary for AWS Backup to restore individual items in a recovery point

  • AWSBackupServiceRolePolicyForS3BackupOperator

    Policy containing permissions necessary for AWS Backup to backup data in any S3 bucket. This includes read access to all S3 objects and any decrypt access for all KMS keys.

  • AWSBackupServiceRolePolicyForS3RestoreOperator

    Policy containing permissions necessary for AWS Backup to restore a S3 backup to a bucket. This includes read/write permissions to all S3 buckets, and permissions to GenerateDataKey and DescribeKey for all KMS keys.

S3 (5)

  • AmazonS3ExpressReadOnlyAccessOperator

    Provides read only access to S3Express operations for S3 directory buckets.

  • AWSDeepRacerFullAccessOperator

    Provides full access to AWS DeepRacer. Also provides select access to related services (e.g., S3).

  • AWSQuickSetupPatchPolicyDeploymentRolePolicyOperator

    Provides permissions that allow Quick Setup to create resources associated with a patch policy configuration.

  • AWSQuickSetupPatchPolicyPermissionsBoundaryOperator

    QuickSetup creates IAM roles which enable it to configure the Systems Manager Patch Manager feature on your behalf, and uses this policy when creating such roles to define the boundary of their permissions.

  • ServerMigrationConnectorOperator

    Permissions to allow the AWS Server Migration Connector to migrate VMs to EC2. Allows communication with the AWS Server Migration Service, read/write access to S3 buckets starting with 'sms-b-' and 'import-to-ec2-' as well as the buckets us…

Systems Manager (4)

  • AWS-SSM-Automation-DiagnosisBucketPolicyOperator

    Provides permissions to access the SSM Diagnosis S3 bucket for diagnosis and remediation of issues.

  • AWS-SSM-DiagnosisAutomation-AdministrationRolePolicyOperator

    Provide permission for Diagnosing issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a cross-account cross-region setup by triggering child automation…

  • AWS-SSM-RemediationAutomation-AdministrationRolePolicyOperator

    Provide permission for Remediating issues with SSM services by executing activities defined within Automation Documents, primarily used for running the Automation documents in a cross-account cross-region setup by triggering child automatio…

  • AWSQuickSetupSSMDeploymentS3BucketRolePolicyOperator

    This policy grants permissions for listing all S3 buckets in an account; and for managing and retrieving information about specific buckets in the principal account that are managed through AWS CloudFormation templates.

Elastic Beanstalk (3)

  • AWSElasticBeanstalkCustomPlatformforEC2RoleOperator

    Provide the instance in your custom platform builder environment permission to launch EC2 instance, create EBS snapshot and AMI, stream logs to Amazon CloudWatch Logs, and store artifacts in Amazon S3.

  • AWSElasticBeanstalkWebTierOperator

    Provide the instances in your web server environment access to upload log files to Amazon S3.

  • AWSElasticBeanstalkWorkerTierOperator

    Provide the instances in your worker environment access to upload log files to Amazon S3, to use Amazon SQS to monitor your application's job queue, to use Amazon DynamoDB to perform leader election, and to Amazon CloudWatch to publish metr…

SageMaker (3)

EFS (2)

S3 Files (2)

Other services (7)

Service roles (23)

SageMaker (6)

EC2 (2)

S3 (2)

  • AWSCostAndUsageReportAutomationPolicyOperator

    Grants permissions to to describe the organization of the account, create S3 buckets for the MAP program and apply tags to it, create a Cost and Usage Report, and describe Cost and Usage Report definitions.

  • ROSAImageRegistryOperatorPolicyOperator

    Allows the OpenShift Image Registry Operator to provision and manage Amazon S3 buckets and objects for use by the Red Hat OpenShift Service on AWS (ROSA) in-cluster image registry to satisfy ROSA storage requirements. The OpenShift Image Re…

Other services (13)

Service-linked roles (11)

Also relevant to Storage (118)
  • AccessAnalyzerServiceRolePolicyReader

    Allow Access Analyzer to analyze resource metadata

  • AdministratorAccess-AWSElasticBeanstalkAdmin

    Grants account administrative permissions. Explicitly allows developers and administrators to gain direct access to resources they need to manage AWS Elastic Beanstalk applications

  • AmazonAppFlowFullAccessAdmin

    Provides full access to Amazon AppFlow and access to AWS services supported as flow source or destination (S3 and Redshift). Also provides access to KMS for encryption

  • AmazonAppStreamServiceAccessOperator

    Default policy for Amazon AppStream service role.

  • AmazonBedrockStudioPermissionsBoundaryOperator

    Defines the maximum permissions of IAM roles that Amazon Bedrock Studio creates for operating Amazon Bedrock Studio resources.

  • AmazonBraketJobsExecutionPolicyOperator

    Grants access to AWS services and resources necessary for executing an Amazon Braket Job including S3, Cloudwatch, IAM and Braket

  • AmazonBraketServiceRolePolicyOperator

    Allows Amazon Braket to create and manage AWS resources on your behalf

  • AmazonCloudWatchEvidentlyFullAccessOperator

    Provides full only access to Amazon CloudWatch Evidently. Also provides access to related Amazon S3, Amazon SNS, Amazon CloudWatch, and other related services.

  • AmazonDataZoneGlueManageAccessRolePolicyOperator

    The policy grants permissions to allow Amazon DataZone to enable publishing and access grants to data.

  • AmazonDataZoneProjectDeploymentPermissionsBoundaryHigh privilegeOperator

    Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

  • AmazonDataZoneSageMakerManageAccessRolePolicyOperator

    The AmazonDataZoneSageMakerManageAccessRolePolicy policy grants Amazon DataZone the permissions required to grant user access to various resources in the SageMaker environment.

  • AmazonDevOpsGuruServiceRolePolicyOperator

    A service-linked role required for Amazon DevOpsGuru to access your resources.

  • AmazonDynamoDBFullAccesswithDataPipelineHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip…

  • AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin

    Default policy for the Amazon EC2 Role for Data Pipeline service role.

  • AmazonEC2RoleforSSMHigh privilegeOperator

    This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userg…

  • AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin

    Default policy for the Amazon Elastic MapReduce for EC2 service role.

  • AmazonElasticMapReduceFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req…

  • AmazonElasticMapReduceRoleHigh privilegeOperator

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Default policy for the Amazon Elastic MapReduce service role.

  • AmazonElasticTranscoder_JobsSubmitterOperator

    Grants users permission to change presets, submit jobs, and view Elastic Transcoder settings. This policy also grants some read-only access to some other services required to use the Elastic Transcode console, including S3, IAM, and SNS.

  • AmazonElasticTranscoder_ReadOnlyAccessReader

    Grants users read-only access to Elastic Transcoder and list access to related services.

  • AmazonElasticTranscoderRoleHigh privilegeOperator

    Default policy for the Amazon Elastic Transcoder service role.

  • AmazonGrafanaAthenaAccessOperator

    This policy grants access to Amazon Athena and the dependencies needed to enable querying and writing results to s3 from the Amazon Athena plugin in Amazon Grafana.

  • AmazonGuardDutyServiceRolePolicyOperator

    Enable access to AWS Resources used or managed by Amazon Guard Duty

  • AmazonInspector2AgentlessServiceRolePolicyOperator

    Grants Amazon Inspector access to AWS services needed to perform agent-less security assessments

  • AmazonLookoutVisionConsoleFullAccessAdmin

    Provides full access to Amazon Lookout for Vision and scoped access to required service and console dependencies.

  • AmazonLookoutVisionConsoleReadOnlyAccessReader

    Provides read only access to Amazon Lookout for Vision and scoped access to required service and console dependencies.

  • AmazonMachineLearningRoleforRedshiftDataSourceV3Operator

    Allows Machine Learning to configure and use your Redshift Clusters and S3 Staging Locations for Redshift Data Source.

  • AmazonNimbleStudio-LaunchProfileWorkerReader

    This policy grants access to resources needed by Nimble Studio Launch Profile workers. Attach this policy to EC2 instances created by Nimble Studio Builder.

  • AmazonRDSCustomInstanceProfileRolePolicyOperator

    Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.

  • AmazonRedshiftAllCommandsFullAccessOperator

    This policy includes permissions to run SQL commands to copy, load, unload, query, and analyze data on Amazon Redshift. The policy also grants permissions to run select statements for related services, such as Amazon S3, Amazon CloudWatch l…

  • AmazonRekognitionCustomLabelsFullAccessOperator

    This policy specifies rekognition and s3 permissions required by Amazon Rekognition Custom Labels feature.

  • AmazonS3FullAccessHigh privilegeAdmin

    Provides full access to all buckets via the AWS Management Console.

  • AmazonS3ObjectLambdaExecutionRolePolicyOperator

    Provides AWS Lambda functions permissions to interact with Amazon S3 Object Lambda. Also grants Lambda permissions to write to CloudWatch Logs.

  • AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyOperator

    Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…

  • AmazonSageMakerCanvasDataPrepFullAccessOperator

    Provides full access to Amazon SageMaker resources and operations for data preparation in Canvas. The policy also provides select access to related services (e.g., S3, IAM, KMS, RDS, CloudWatch Logs, Redshift, Athena, Glue, EventBridge, Sec…

  • AmazonSageMakerClusterInstanceRolePolicyOperator

    This policy grants permissions commonly needed to use Amazon SageMaker Cluster.

  • AmazonSageMakerEdgeDeviceFleetPolicyOperator

    Provides permissions necessary for SageMaker Edge to create and manage a device fleet for the customer using the default cloud connection.

  • AmazonSageMakerGroundTruthExecutionOperator

    Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job

  • AmazonSageMakerHyperPodInferenceAccessOperator

    This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…

  • AmazonSageMakerModelGovernanceUseAccessOperator

    This AWS managed policy grants permissions needed to use all Amazon SageMaker Governance features. The policy also provides select access to related services (e.g., S3, KMS).

  • AmazonSageMakerNotebooksServiceRolePolicyOperator

    Managed policy for Service Linked Role for Amazon SageMaker Notebooks

  • AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicyOperator

    Service role policy used by the AWS CodePipeline within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others…

  • AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator

    Service role policy used by the AWS Glue within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Glue, S3 and others.

  • AmazonSageMakerTrainingSessionAccessOperator

    Provides permissions for a caller identity to create and manage Amazon SageMaker training sessions, run training and sampling operations, use customer managed AWS KMS keys through SageMaker, pass an execution role to SageMaker, publish mode…

  • AmazonSageMakerTrainingSessionFullAccessOperator

    Provides permissions for Amazon SageMaker training session execution roles to access data in Amazon S3, use customer managed AWS KMS keys, publish model packages, access public hub content, and manage Amazon VPC network interfaces.

  • AmazonSecurityLakePermissionsBoundaryHigh privilegeOperator

    Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th…

  • ApplicationDiscoveryServiceContinuousExportServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by Application Discovery Service Continuous Export feature

  • AWSAgentlessDiscoveryServiceAdmin

    Provides access for the Discovery Agentless Connector to register with AWS Application Discovery Service.

  • AWSBackupServiceLinkedRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForBackupOperator

    Provides AWS Backup permission to create backups on your behalf across AWS services

  • AWSBackupServiceRolePolicyForRestoresOperator

    Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…

  • AWSCodeDeployRoleForECSOperator

    Provides CodeDeploy service wide access to perform an ECS blue/green deployment on your behalf. Grants full access to support services, such as full access to read all S3 objects, invoke all Lambda functions, publish to all SNS topics withi…

  • AWSCodeDeployRoleForECSLimitedOperator

    Provides CodeDeploy service limited access to perform an ECS blue/green deployment on your behalf.

  • AWSCodeDeployRoleForLambdaOperator

    Provides CodeDeploy service access to perform a Lambda deployment on your behalf.

  • AWSCodeDeployRoleForLambdaLimitedOperator

    Provides CodeDeploy service limited access to perform a Lambda deployment on your behalf.

  • AWSCodePipeline_ReadOnlyAccessReader

    Provides read only access to AWS CodePipeline via the AWS Management Console.

  • AWSCodeStarServiceRoleAdmin

    DO NOT USE - AWS CodeStar Service Role Policy which grants administrative privileges in order for CodeStar to manage IAM and other service resources on behalf of the customer.

  • AWSConnectorOperator

    Enables broad read/write access to ALL EC2 objects, read/write access to S3 buckets starting with 'import-to-ec2-', and the ability to list all S3 buckets, for the AWS Connector to import VMs on your behalf.

  • AWSContinuumCollectorServiceRolePolicyOperator

    Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.

  • AWSDataExchangeSubscriberFullAccessOperator

    Grants data subscriber access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.

  • AWSDataPipeline_FullAccessAdmin

    Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles.

  • AWSDataPipeline_PowerUserAdmin

    Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles.

  • AWSDataSyncFullAccessAdmin

    Provides full access to AWS DataSync and minimal access to its dependencies

  • AWSDataSyncReadOnlyAccessReader

    Provides read-only access to AWS DataSync

  • AWSDeepLensLambdaFunctionAccessPolicyOperator

    This policy specifies permissions required by DeepLens Administrative lambda functions that run on a DeepLens device

  • AWSDMSServerlessServiceRolePolicyOperator

    Grants AWS DMS Serverless permissions to create and manage DMS resources in your account on your behalf

  • AWSElasticBeanstalkEKSImageBuildOperator

    Permissions needed by Elastic Beanstalk to build container images on behalf of customer.

  • AWSElasticBeanstalkEKSObservabilityOperator

    Observability permissions for Elastic Beanstalk environments running in Elastic Kubernetes Service cluster

  • AWSElasticBeanstalkRoleCoreOperator

    AWSElasticBeanstalkRoleCore (Elastic Beanstalk operations role) Allows core operation of a web service environment.

  • AWSElasticBeanstalkServiceHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/iam-servicerole.html. AWS Elastic Beanstalk Service role policy which grants permissions to create & manage resourc…

  • AWSElementalMediaConvertReadOnlyReader

    Provides read only access to AWS Elemental MediaConvert via the AWS Management Console and SDK.

  • AWSForWordPressPluginPolicyOperator

    Managed policy for AWS For Wordpress Plugin

  • AWSGlueServiceNotebookRoleOperator

    Policy for AWS Glue service role which allows customer to manage notebook server

  • AWSIoTDeviceTesterForFreeRTOSFullAccessOperator

    Allows AWS IoT Device Tester to run the FreeRTOS qualification suite by allowing access to services including IoT, S3, and IAM

  • AWSIoTRuleActionsHigh privilegeOperator

    Allows access to all AWS services supported in AWS IoT Rule Actions

  • AWSLambdaFullAccessHigh privilegeAdmin

    This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs.

  • AWSLicenseManagerMasterAccountRolePolicyOperator

    AWS License Manager service master account role policy

  • AWSM2ServicePolicyOperator

    Allows AWS M2 to manage AWS resources on your behalf.

  • AWSManagedServices_ContactsServiceRolePolicyReader

    Allows AWS Managed Services to read the values of the tags on AWS resources

  • AWSMigrationHubOrchestratorConsoleFullAccessAdmin

    Provides limited access to AWS Migration Hub, AWS Application Discovery Service, Amazon Simple Storage Service and AWS Secrets Manager. This policy also grants full access to AWS Migration Hub Orchestrator service.

  • AWSMigrationHubStrategyCollectorOperator

    Grants permissions to allow communication with the AWS Migration Hub Strategy Recommendations service, read/write access to S3 buckets related to the service, Amazon API Gateway access to upload logs and metrics to AWS, AWS Secrets Manager …

  • AWSMigrationHubStrategyConsoleFullAccessAdmin

    Grants full access to the AWS Migration Hub Strategy Recommendations service and access to related AWS services through the AWS Management Console.

  • AWSMobileHub_FullAccessOperator

    This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

  • AWSPanoramaApplianceServiceRolePolicyOperator

    Allows an AWS Panorama Appliance to upload logs to Amazon CloudWatch, and to get objects from Amazon S3 access points created for use with AWS Panorama.

  • AWSPanoramaGreengrassGroupRolePolicyAdmin

    Allows an AWS Lambda function on an AWS Panorama Appliance to manage resources in Panorama, upload logs and metrics to Amazon CloudWatch, and to manage objects in buckets created for use with Panorama.

  • AWSPanoramaServiceRolePolicyOperator

    Allows AWS Panorama to manage resources in Amazon S3, AWS IoT, AWS IoT GreenGrass, AWS Lambda, Amazon SageMaker, and Amazon CloudWatch Logs, and to pass service roles to AWS IoT, AWS IoT GreenGrass, and Amazon SageMaker.

  • AWSQuickSetupSSMManageResourcesExecutionPolicyOperator

    This policy grants permissions that allow Systems Manager to create prerequisites such as IAM roles required for Systems Manager onboarding.

  • AWSQuicksightAthenaAccessOperator

    Quicksight access to Athena API and S3 buckets used for Athena query results

  • AWSQuickSightSageMakerPolicyOperator

    Provides access to Amazon SageMaker resources from Amazon QuickSight

  • AWSRefactoringToolkitSidecarPolicyOperator

    This policy is intended to be used by Amazon ECS Tasks created for testing applications in AWS using the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. The policy grants access to download application artifacts from…

  • AWSResourceGroupsReadOnlyAccessReader

    This is the read only policy for AWS Resource Groups

  • AWSServiceRoleForSMSOperator

    Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.

  • AWSServiceRolePolicyForBackupReportsOperator

    Provides AWS Backup permissions to create compliance reports on your behalf

  • AWSSystemsManagerEnableConfigRecordingExecutionPolicyOperator

    Provides permissions for AWS Systems Manager Quick Setup to enable and configure AWS Config configuration recording.

  • AWSThinkboxAWSPortalAdminPolicyOperator

    This policy grants AWS Thinkbox's Deadline software full access to multiple AWS services as required for AWS Portal administration. This includes access to create arbitrary tags on several EC2 resource types.

  • AWSThinkboxAWSPortalGatewayPolicyOperator

    This policy grants the AWS Portal Gateway machine the necessary permissions required for normal operation.

  • AWSThinkboxAWSPortalWorkerPolicyOperator

    This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.

  • AWSTransformApplicationDeploymentPolicyOperator

    Enables the AWS Transform service to deploy transformed .NET applications by creating and managing AWS resources. This policy grants permissions to provision infrastructure, manage compute resources, and configure deployment settings across…

  • AWSTransformLandingZoneAgentPolicyOperator

    Grants permissions for AWS Transform to set up AWS landing zones including account provisioning, organizational governance, and Control Tower configuration

  • AWSTransformSecurityAgentExecutorAccessOperator

    Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.

  • AWSTransformServerMigrationAgentPolicyOperator

    Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

  • ConfigConformsServiceRolePolicyOperator

    Policy needed for AWSConfig to create conformance packs

  • ConsoleFullAccessFromVercelHigh privilegeOperator

    For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to manage all resources for the services that are integrated with the Vercel Marketplace.

  • DatabaseAdministratorHigh privilegeAdmin

    Grants full access permissions to AWS services and actions required to set up and configure AWS database services.

  • DBModProvisioningAndMigrationOperator

    Resource provisioning and data migration permissions for database connector used in database modernization

  • DBModVirtualSourceOperator

    Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

  • GameLiftContainerFleetPolicyOperator

    Grants the required permissions for compute actions in an Amazon GameLift container fleet, including access to dependencies such as Amazon S3.

  • LightsailExportAccessOperator

    AWS Lightsail service linked role policy which grants permissions to export resources

  • Route53ResolverServiceRolePolicyOperator

    Enables access to AWS services and Resources used or managed by Route53 Resolver

  • SageMakerStudioAdminProjectUserRolePolicyOperator

    This IAM policy grants an IAM role full access to AWS Glue Data Catalog (metadata) and Amazon S3 (actual data) for data lake operations, with access scoped by account, and role tags.

  • SageMakerStudioBedrockAgentServiceRolePolicyOperator

    Allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in SageMaker Studio.

  • SageMakerStudioBedrockChatAgentUserRolePolicyOperator

    Provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in SageMaker Studio.

  • SageMakerStudioDataAppsAccessRolePolicyOperator

    Amazon SageMaker Studio uses this policy to access data apps shared with a user in the Amazon SageMaker Studio domain.

  • SageMakerStudioEMRInstanceRolePolicyOperator

    Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

  • SageMakerStudioQueryExecutionRolePolicyOperator

    Amazon SageMaker Studio uses this policy when running query executions on federated connections.

  • SecurityLakeResourceManagementServiceRolePolicyOperator

    Provides access to manage resources created by Security Lake.

  • ServerMigration_ServiceRoleOperator

    Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.

  • TranslateFullAccessAdmin

    Provides full access to Amazon Translate.

IAM Policy MapCreated by Mavrick HardingUnofficial community resource. Not affiliated with, endorsed by or sponsored by Amazon Web Services.