Storage: Reader policies
Object, block, file and archive storage, plus backup.
23 AWS managed policies. 5 have reviewed guidance; the rest have authoritative permission data pending editorial review. 2 are service-linked role policies, shown with permission data only.
User access (16)
S3 (5)
- AmazonS3ReadOnlyAccessReader
Provides read only access to all buckets via the AWS Management Console.
- AmazonS3TablesReadOnlyAccessReader
Provides read only access to all S3 table buckets.
- AWSQuickSetupPatchPolicyBaselineAccessReader
Provides read-only permissions to access patch baselines that have been configured by an administrator in the current AWS account or organization using Quick Setup.
- GroundTruthSyntheticConsoleFullAccessReader
This policy grants permissions needed to use all features of the SageMaker Ground Truth Synthetic Console.
- GroundTruthSyntheticConsoleReadOnlyAccessReader
This policy grants read-only access to SageMaker Ground Truth Synthetic via the AWS Management Console.
FSx (2)
- AmazonFSxConsoleReadOnlyAccessReader
Provides read only access to Amazon FSx and access to related AWS services via the AWS Management Console.
- AmazonFSxReadOnlyAccessReader
Provides read only access to Amazon FSx.
EFS (2)
- AmazonElasticFileSystemClientReadOnlyAccessReader
Provides read only client access to an Amazon EFS file system
- AmazonElasticFileSystemReadOnlyAccessReader
Provides read only access to Amazon EFS via the AWS Management Console.
S3 Files (2)
- AmazonS3FilesClientReadOnlyAccessReader
Provides read only client access to an S3 Files file system.
- AmazonS3FilesReadOnlyAccessReader
Provides read only access to all S3 Files via the AWS Management Console.
Glacier (1)
- AmazonGlacierReadOnlyAccessReader
Provides read only access to Amazon Glacier via the AWS Management Console.
S3 Outposts (1)
- AmazonS3OutpostsReadOnlyAccessReader
Provides read only access to Amazon S3 on Outposts via the AWS Management Console.
Storage Gateway (1)
- AWSStorageGatewayReadOnlyAccessReader
Provides access to AWS Storage Gateway via the AWS Management Console.
Other services (2)
- AWSMigrationHubOrchestratorInstanceRolePolicyReader
This policy needs to be attached for SAP and MGN migrated instance for our service to orchestrate instances by downloading scripts from S3 and to fetch secret values inside EC2 instance.
- ConsoleViewOnlyAccessFromVercelReader
For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to view all resources for the services that are integrated with the Vercel Marketplace.
Service roles (5)
EC2 (2)
- AmazonEC2RoleforAWSCodeDeployReader
Provides EC2 access to S3 bucket to download revision. This role is needed by the CodeDeploy agent on EC2 instances.
- AmazonEC2RoleforAWSCodeDeployLimitedReader
Provides EC2 limited access to S3 bucket to download revision. This role is needed by the CodeDeploy agent on EC2 instances.
Other services (3)
- AmazonMacieServiceRoleReader
Grants Macie read-only access to resource dependencies in your account in order to enable data analysis.
- GreengrassOTAUpdateArtifactAccessReader
Provides read access to the Greengrass OTA Update artifacts in all Greengrass regions
- QuickSightAccessForS3StorageManagementAnalyticsReadOnlyReader
Policy used by QuickSight team to access customer data produced by S3 Storage Management Analytics.
Service-linked roles (2)
- AWSStorageGatewayServiceRolePolicyReader
Service-linked role used by AWS Storage Gateway to enable integration of other AWS services with Storage Gateway.
- LakeFormationDataAccessServiceRolePolicyReader
Policy to grant temporary data access to Lake Formation resources
Also relevant to Storage (9)
- AccessAnalyzerServiceRolePolicyReader
Allow Access Analyzer to analyze resource metadata
- AmazonElasticTranscoder_ReadOnlyAccessReader
Grants users read-only access to Elastic Transcoder and list access to related services.
- AmazonLookoutVisionConsoleReadOnlyAccessReader
Provides read only access to Amazon Lookout for Vision and scoped access to required service and console dependencies.
- AmazonNimbleStudio-LaunchProfileWorkerReader
This policy grants access to resources needed by Nimble Studio Launch Profile workers. Attach this policy to EC2 instances created by Nimble Studio Builder.
- AWSCodePipeline_ReadOnlyAccessReader
Provides read only access to AWS CodePipeline via the AWS Management Console.
- AWSDataSyncReadOnlyAccessReader
Provides read-only access to AWS DataSync
- AWSElementalMediaConvertReadOnlyReader
Provides read only access to AWS Elemental MediaConvert via the AWS Management Console and SDK.
- AWSManagedServices_ContactsServiceRolePolicyReader
Allows AWS Managed Services to read the values of the tags on AWS resources
- AWSResourceGroupsReadOnlyAccessReader
This is the read only policy for AWS Resource Groups