Storage: Operator policies

Default policy for Amazon AppStream service role.

Defines the maximum permissions of IAM roles that Amazon Bedrock Studio creates for operating Amazon Bedrock Studio resources.

Grants access to AWS services and resources necessary for executing an Amazon Braket Job including S3, Cloudwatch, IAM and Braket

Allows Amazon Braket to create and manage AWS resources on your behalf

Provides full only access to Amazon CloudWatch Evidently. Also provides access to related Amazon S3, Amazon SNS, Amazon CloudWatch, and other related services.

The policy grants permissions to allow Amazon DataZone to enable publishing and access grants to data.

Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions.

The AmazonDataZoneSageMakerManageAccessRolePolicy policy grants Amazon DataZone the permissions required to grant user access to various resources in the SageMaker environment.

A service-linked role required for Amazon DevOpsGuru to access your resources.

This policy will soon be deprecated. Please use AmazonSSMManagedInstanceCore policy to enable AWS Systems Manager service core functionality on EC2 instances. For more information see https://docs.aws.amazon.com/systems-manager/latest/userg…

This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Default policy for the Amazon Elastic MapReduce service role.

Grants users permission to change presets, submit jobs, and view Elastic Transcoder settings. This policy also grants some read-only access to some other services required to use the Elastic Transcode console, including S3, IAM, and SNS.

Default policy for the Amazon Elastic Transcoder service role.

This policy grants access to Amazon Athena and the dependencies needed to enable querying and writing results to s3 from the Amazon Athena plugin in Amazon Grafana.

Enable access to AWS Resources used or managed by Amazon Guard Duty

Grants Amazon Inspector access to AWS services needed to perform agent-less security assessments

Allows Machine Learning to configure and use your Redshift Clusters and S3 Staging Locations for Redshift Data Source.

Allows Amazon RDS Custom to perform various automation actions and database management tasks through an EC2 instance profile.

This policy includes permissions to run SQL commands to copy, load, unload, query, and analyze data on Amazon Redshift. The policy also grants permissions to run select statements for related services, such as Amazon S3, Amazon CloudWatch l…

This policy specifies rekognition and s3 permissions required by Amazon Rekognition Custom Labels feature.

Provides AWS Lambda functions permissions to interact with Amazon S3 Object Lambda. Also grants Lambda permissions to write to CloudWatch Logs.

Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…

Provides full access to Amazon SageMaker resources and operations for data preparation in Canvas. The policy also provides select access to related services (e.g., S3, IAM, KMS, RDS, CloudWatch Logs, Redshift, Athena, Glue, EventBridge, Sec…

This policy grants permissions commonly needed to use Amazon SageMaker Cluster.

Provides permissions necessary for SageMaker Edge to create and manage a device fleet for the customer using the default cloud connection.

Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job

This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…

This AWS managed policy grants permissions needed to use all Amazon SageMaker Governance features. The policy also provides select access to related services (e.g., S3, KMS).

Managed policy for Service Linked Role for Amazon SageMaker Notebooks

Service role policy used by the AWS CodePipeline within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others…

Service role policy used by the AWS Glue within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including Glue, S3 and others.

Provides permissions for a caller identity to create and manage Amazon SageMaker training sessions, run training and sampling operations, use customer managed AWS KMS keys through SageMaker, pass an execution role to SageMaker, publish mode…

Provides permissions for Amazon SageMaker training session execution roles to access data in Amazon S3, use customer managed AWS KMS keys, publish model packages, access public hub content, and manage Amazon VPC network interfaces.

Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th…

Enables access to AWS services and Resources used or managed by Application Discovery Service Continuous Export feature

Provides AWS Backup permission to create backups on your behalf across AWS services

Provides AWS Backup permission to create backups on your behalf across AWS services

Provides AWS Backup permission to perform restores on your behalf across AWS services. This policy includes permissions to create and delete AWS resources, such as EBS volumes, RDS instances, and EFS file systems, which are part of the rest…

Provides CodeDeploy service wide access to perform an ECS blue/green deployment on your behalf. Grants full access to support services, such as full access to read all S3 objects, invoke all Lambda functions, publish to all SNS topics withi…

Provides CodeDeploy service limited access to perform an ECS blue/green deployment on your behalf.

Provides CodeDeploy service access to perform a Lambda deployment on your behalf.

Provides CodeDeploy service limited access to perform a Lambda deployment on your behalf.

Enables broad read/write access to ALL EC2 objects, read/write access to S3 buckets starting with 'import-to-ec2-', and the ability to list all S3 buckets, for the AWS Connector to import VMs on your behalf.

Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.

Grants data subscriber access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. It also provides select access to related services needed to take full advantage of AWS Data Exchange.

This policy specifies permissions required by DeepLens Administrative lambda functions that run on a DeepLens device

Grants AWS DMS Serverless permissions to create and manage DMS resources in your account on your behalf

Permissions needed by Elastic Beanstalk to build container images on behalf of customer.

Observability permissions for Elastic Beanstalk environments running in Elastic Kubernetes Service cluster

AWSElasticBeanstalkRoleCore (Elastic Beanstalk operations role) Allows core operation of a web service environment.

Managed policy for AWS For Wordpress Plugin

Policy for AWS Glue service role which allows customer to manage notebook server

Allows AWS IoT Device Tester to run the FreeRTOS qualification suite by allowing access to services including IoT, S3, and IAM

Allows access to all AWS services supported in AWS IoT Rule Actions

AWS License Manager service master account role policy

Allows AWS M2 to manage AWS resources on your behalf.

Grants permissions to allow communication with the AWS Migration Hub Strategy Recommendations service, read/write access to S3 buckets related to the service, Amazon API Gateway access to upload logs and metrics to AWS, AWS Secrets Manager …

This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

Allows an AWS Panorama Appliance to upload logs to Amazon CloudWatch, and to get objects from Amazon S3 access points created for use with AWS Panorama.

Allows AWS Panorama to manage resources in Amazon S3, AWS IoT, AWS IoT GreenGrass, AWS Lambda, Amazon SageMaker, and Amazon CloudWatch Logs, and to pass service roles to AWS IoT, AWS IoT GreenGrass, and Amazon SageMaker.

This policy grants permissions that allow Systems Manager to create prerequisites such as IAM roles required for Systems Manager onboarding.

Quicksight access to Athena API and S3 buckets used for Athena query results

Provides access to Amazon SageMaker resources from Amazon QuickSight

This policy is intended to be used by Amazon ECS Tasks created for testing applications in AWS using the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. The policy grants access to download application artifacts from…

Provides access to AWS services and resources necessary to migrate service instances into AWS including EC2, S3 and Cloudformation.

Provides AWS Backup permissions to create compliance reports on your behalf

Provides permissions for AWS Systems Manager Quick Setup to enable and configure AWS Config configuration recording.

This policy grants AWS Thinkbox's Deadline software full access to multiple AWS services as required for AWS Portal administration. This includes access to create arbitrary tags on several EC2 resource types.

This policy grants the AWS Portal Gateway machine the necessary permissions required for normal operation.

This policy grants the Deadline Workers in AWS Portal the necessary permissions required for normal operation.

Enables the AWS Transform service to deploy transformed .NET applications by creating and managing AWS resources. This policy grants permissions to provision infrastructure, manage compute resources, and configure deployment settings across…

Grants permissions for AWS Transform to set up AWS landing zones including account provisioning, organizational governance, and Control Tower configuration

Grants AWS Transform (ATX) Continuous Modernization CLI/agent the permissions needed to invoke the AWS Security Agent service for automated code security reviews and remediation, including uploading scan artifacts and retrieving findings.

Grants permissions for AWS Transform to perform server migration operations including replication, testing, and cutover using AWS Application Migration Service

Policy needed for AWSConfig to create conformance packs

For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to manage all resources for the services that are integrated with the Vercel Marketplace.

Resource provisioning and data migration permissions for database connector used in database modernization

Provides permissions for the database connector used by ATXHelix during the offline (DMS-free) database modernization workflow

Grants the required permissions for compute actions in an Amazon GameLift container fleet, including access to dependencies such as Amazon S3.

AWS Lightsail service linked role policy which grants permissions to export resources

Enables access to AWS services and Resources used or managed by Route53 Resolver

This IAM policy grants an IAM role full access to AWS Glue Data Catalog (metadata) and Amazon S3 (actual data) for data lake operations, with access scoped by account, and role tags.

Allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in SageMaker Studio.

Provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in SageMaker Studio.

Amazon SageMaker Studio uses this policy to access data apps shared with a user in the Amazon SageMaker Studio domain.

Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR.

Amazon SageMaker Studio uses this policy when running query executions on federated connections.

Provides access to manage resources created by Security Lake.

Permissions to allow the AWS Server Migration Service to migrate VMs to EC2: allows the Server Migration Service to place the migrated resources into the customer's EC2 account.