# IAM Policy Map: reviewed policy guides > Reviewed guides for AWS managed policies, with computed privilege tiers and their reasons, FAQs and cited sources. Generated by `pnpm export`. Version 0.0.0. AWS data snapshot 2026-11-13. Unofficial; not affiliated with Amazon Web Services. 152 guides. Each guide was reviewed against the policy version shown. Tiers are computed by rules from the policy's permissions; the guide text may not contradict them. Action lists are not repeated here; each policy links to its actions.json. ## AIDevOpsAgentActionsPolicy - Page: https://iampolicymap.com/policies/aidevopsagentactionspolicy/ - ARN: `arn:aws:iam::aws:policy/AIDevOpsAgentActionsPolicy` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: admin; High privilege. Distinct granted actions: 21519 control plane, 478 data plane, 4435 unclassified. - AWS description: Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events. - Actions: https://iampolicymap.com/policies/aidevopsagentactionspolicy/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: a4b (61 of 61), access-analyzer (15 of 15), acm (20 of 20), acm-pca (12 of 12), aco-automation (8 of 8), agent-registry (10 of 10), agentaccess-mcp (21 of 21), aidevops (45 of 45), aiops (15 of 15), and 348 more. - Grants data-plane write actions on a data store on all resources without conditions. - 215 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary Provides elevated permissions required by the AWS DevOps Agent to perform operator-approved mutations or elevated actions on customer AWS resources during operational events. ### Practical scope The AIDevOpsElevatedAccess statement allows every action on Resource "*" except those matched by its NotAction list: account:*, cognito-identity:*, iam:*, identitystore:*, organizations:*, ram:*, rolesanywhere:*, sso:* and sts:*. The AIDevOpsElevatedCarveBacks statement then allows account:GetAccountInformation, account:GetGovCloudAccountInformation, account:GetPrimaryEmail, account:ListRegions, iam:ListRoles, organizations:DescribeEffectivePolicy, organizations:DescribeOrganization and sts:DecodeAuthorizationMessage on Resource "*". ### Use cases - Provide the elevated permissions the AWS DevOps Agent needs to perform operator-approved mutations or elevated actions on customer AWS resources during operational events. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The AIDevOpsElevatedAccess statement uses NotAction with an Allow effect. The IAM User Guide warns that this can grant more permissions than you intended, because it matches every service and action that is not listed. This statement allows all actions outside the nine excluded prefixes on all resources. - The excluded prefixes (account, cognito-identity, iam, identitystore, organizations, ram, rolesanywhere, sso and sts) are not allowed by this statement. The IAM User Guide says actions in NotAction are not impacted by the Allow or Deny effect, so listing them does not deny them. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The description says the AWS DevOps Agent needs it to perform operator-approved mutations or elevated actions during operational events. It allows nearly every action on all resources. ### FAQs **When should I attach AIDevOpsAgentActionsPolicy?** The description says it provides the elevated permissions the AWS DevOps Agent needs to perform operator-approved mutations or elevated actions on customer AWS resources during operational events. The reference page says you can attach it to your users, groups and roles. **What does AIDevOpsAgentActionsPolicy grant?** On all resources it allows every action except those matching account:*, cognito-identity:*, iam:*, identitystore:*, organizations:*, ram:*, rolesanywhere:*, sso:* and sts:*. A second statement allows eight actions from the account, iam, organizations and sts prefixes. **What are the security risks of AIDevOpsAgentActionsPolicy?** A NotAction statement with an Allow effect allows every action it does not list, on all resources. The IAM User Guide warns this could grant users more permissions than you intended. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AIDevOpsAgentActionsPolicy (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AIDevOpsAgentActionsPolicy.md), retrieved 2026-11-13 - [IAM JSON policy elements: NotAction (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSCODAPermissionsBoundary - Page: https://iampolicymap.com/policies/awscodapermissionsboundary/ - ARN: `arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary` - Kind: standard. Domain: privileged. Default version: v1. Guide reviewed against: v1. - Tier: admin; High privilege. Distinct granted actions: 22043 control plane, 483 data plane, 4488 unclassified. - AWS description: AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions. - Actions: https://iampolicymap.com/policies/awscodapermissionsboundary/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: a4b (61 of 61), access-analyzer (15 of 15), account (12 of 12), acm (20 of 20), acm-pca (12 of 12), aco-automation (8 of 8), agent-registry (10 of 10), agentaccess-mcp (21 of 21), aidevops (45 of 45), and 357 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole on all resources without conditions. - Grants permissions-management actions on iam on all resources without conditions. - Grants permissions-management actions on organizations on all resources without conditions. - Grants permissions-management actions on sso on all resources without conditions. - 215 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions. ### Practical scope The first statement allows every action on Resource "*" except those matched by its NotAction list: iam:CreateRole, iam:CreateUser, iam:DeleteRolePermissionsBoundary, iam:PutRolePermissionsBoundary and sts:AssumeRoot. The second statement allows iam:CreateRole, iam:CreateUser and iam:PutRolePermissionsBoundary on Resource "*" only when iam:PermissionsBoundary matches arn:*:iam::aws:policy/AWSCODAPermissionsBoundary. ### Use cases - Review the boundary that AWS CODA applies to the IAM roles it creates for delegations. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - A permissions boundary sets the maximum permissions an identity-based policy can grant to a user or role and does not provide permissions on its own. The IAM User Guide says an entity can perform only the actions allowed by both its identity-based policies and its boundary. - The first statement uses NotAction with an Allow effect, so the maximum it sets is wide: every action except five IAM and STS actions. The IAM User Guide warns that NotAction with Allow could grant more permissions than you intended. - Creating roles or users, or setting a role's permissions boundary, is allowed only when the iam:PermissionsBoundary condition is this same boundary. iam:DeleteRolePermissionsBoundary and sts:AssumeRoot are not allowed. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide says you can use an AWS managed policy to set the boundary for a user or role. The description says AWS CODA uses this policy when it creates roles for delegations. A boundary gives no access without an identity-based policy. ### FAQs **When should I attach AWSCODAPermissionsBoundary?** The description says AWS CODA uses it when creating IAM roles for delegations, to define the boundary of their permissions. The reference page says you can attach it to your users, groups and roles, and the IAM User Guide says you can use an AWS managed policy to set a permissions boundary. **What does AWSCODAPermissionsBoundary grant?** As a permissions boundary it sets the maximum permissions: every action except iam:CreateRole, iam:CreateUser, iam:DeleteRolePermissionsBoundary, iam:PutRolePermissionsBoundary and sts:AssumeRoot, with iam:CreateRole, iam:CreateUser and iam:PutRolePermissionsBoundary allowed only when the iam:PermissionsBoundary condition is this same boundary. It does not provide permissions on its own. **What are the security risks of AWSCODAPermissionsBoundary?** The boundary allows nearly every action on all resources, so it limits little beyond IAM and STS. It uses NotAction with Allow, which the IAM User Guide warns could grant more permissions than you intended. An AWS update to the policy affects every identity it is attached to. ### Sources - [AWSCODAPermissionsBoundary (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCODAPermissionsBoundary.md), retrieved 2026-11-13 - [Permissions boundaries for IAM entities (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.md), retrieved 2026-11-13 - [IAM JSON policy elements: NotAction (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSCertificateManagerFullAccess - Page: https://iampolicymap.com/policies/awscertificatemanagerfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCertificateManagerFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 46 control plane, 0 data plane, 21 unclassified. - AWS description: Provides full access to AWS Certificate Manager (ACM) - Actions: https://iampolicymap.com/policies/awscertificatemanagerfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: acm (20 of 20). ### Summary Provides full access to AWS Certificate Manager (ACM). The AWS Certificate Manager User Guide says it provides full access to all ACM actions and resources. ### Practical scope The first statement allows acm:* on Resource "*". iam:CreateServiceLinkedRole is allowed only on roles matching arn:aws:iam::*:role/aws-service-role/acm.amazonaws.com/AWSServiceRoleForCertificateManager*, with an iam:AWSServiceName condition of acm.amazonaws.com. iam:DeleteServiceLinkedRole, iam:GetServiceLinkedRoleDeletionStatus and iam:GetRole are allowed on the same role pattern. ### Use cases - Give users, groups or roles full access to ACM actions and resources. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Certificate Manager User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - acm:* allows every ACM action on all resources. - The policy also allows iam:DeleteServiceLinkedRole on the ACM service-linked role pattern, not only creating it. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to ACM is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AWSCertificateManagerFullAccess?** The AWS Certificate Manager User Guide says it provides full access to all ACM actions and resources. Attach it to users, groups or roles that need that scope. If they need less, AWS recommends customer managed policies specific to your use cases. **What does AWSCertificateManagerFullAccess grant?** It allows acm:* on all resources. It also allows creating the ACM service-linked role (AWSServiceRoleForCertificateManager*) when the service name is acm.amazonaws.com, and deleting that role, checking its deletion status and getting it with iam:GetRole. **What are the security risks of AWSCertificateManagerFullAccess?** acm:* allows every ACM action on all resources, and the policy includes the ability to delete the ACM service-linked role. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSCertificateManagerFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCertificateManagerFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Certificate Manager (AWS Certificate Manager User Guide)](https://docs.aws.amazon.com/acm/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSCertificateManagerReadOnly - Page: https://iampolicymap.com/policies/awscertificatemanagerreadonly/ - ARN: `arn:aws:iam::aws:policy/AWSCertificateManagerReadOnly` - Kind: standard. Domain: security-identity-compliance. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 16 control plane, 0 data plane, 8 unclassified. - AWS description: Provides read only access to AWS Certificate Manager (ACM). - Actions: https://iampolicymap.com/policies/awscertificatemanagerreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to AWS Certificate Manager (ACM). The AWS Certificate Manager User Guide says it allows users to describe, list, search and retrieve ACM certificates, and includes describe and list permissions for ACME certificate automation resources. ### Practical scope A single Allow statement on Resource "*" with these actions: acm:DescribeCertificate, ListCertificates, SearchCertificates, GetCertificate, ListTagsForCertificate, GetAccountConfiguration, ListTagsForResource, ListCertificateDomainValidations, and the ACME actions DescribeAcmeAccount, DescribeAcmeDomainValidation, DescribeAcmeEndpoint, DescribeAcmeExternalAccountBinding, ListAcmeAccounts, ListAcmeDomainValidations, ListAcmeEndpoints and ListAcmeExternalAccountBindings. ### Use cases - Let users inspect ACM certificates and ACME certificate automation resources without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Certificate Manager User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows acm:GetCertificate and acm:SearchCertificates on all resources. The AWS Certificate Manager User Guide describes the policy as letting users retrieve ACM certificates. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read only access to ACM is intended. ### FAQs **When should I attach AWSCertificateManagerReadOnly?** The AWS Certificate Manager User Guide describes it as read-only access to ACM certificates. Attach it to users, groups or roles that need to describe, list, search and retrieve certificates and view ACME certificate automation resources, but not change them. **What does AWSCertificateManagerReadOnly grant?** It allows describe, list, search and get actions for ACM certificates (DescribeCertificate, ListCertificates, SearchCertificates, GetCertificate, ListTagsForCertificate, ListCertificateDomainValidations), GetAccountConfiguration, ListTagsForResource, and describe and list actions for ACME accounts, domain validations, endpoints and external account bindings, all on all resources. **What are the security risks of AWSCertificateManagerReadOnly?** The actions are read only, but they apply to all resources and include retrieving ACM certificates. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. The policy was last edited on August 13, 2026. ### Sources - [AWSCertificateManagerReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCertificateManagerReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for AWS Certificate Manager (AWS Certificate Manager User Guide)](https://docs.aws.amazon.com/acm/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSCleanRoomsFullAccessNoQuerying - Page: https://iampolicymap.com/policies/awscleanroomsfullaccessnoquerying/ - ARN: `arn:aws:iam::aws:policy/AWSCleanRoomsFullAccessNoQuerying` - Kind: standard. Domain: analytics. Default version: v7. Guide reviewed against: v7. - Tier: operator. Distinct granted actions: 74 control plane, 0 data plane, 6 unclassified. - AWS description: Allows full access to AWS Clean Rooms resources except for querying in a collaboration and access to related AWS services. - Actions: https://iampolicymap.com/policies/awscleanroomsfullaccessnoquerying/actions.json ### Tier reasons - Grants 29 write, tagging or permissions-management actions, short of full control of any service. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Allows full access to AWS Clean Rooms resources except for querying in a collaboration and access to related AWS services. The AWS Clean Rooms User Guide says it grants administrative permissions for full access (read, write and update) to resources and metadata in a collaboration, and excludes access to perform queries. ### Practical scope Fourteen statements. CleanRoomsAccess allows 46 cleanrooms actions on Resource "*" (create, update, delete, get, list and tag actions for collaborations, analysis templates, configured tables and memberships). CleanRoomsNoQuerying denies cleanrooms:StartProtectedQuery and cleanrooms:UpdateProtectedQuery. PassServiceRole allows iam:PassRole on roles under service-role/ with cleanrooms in the name, only to cleanrooms.amazonaws.com. Further iam statements list roles and policies and read roles and policies whose names include cleanrooms. ConsoleDisplayTables allows nine read-only glue actions. Log statements allow log delivery and log group setup actions (including logs:PutResourcePolicy) only when called via cleanrooms.amazonaws.com, plus logs:StartQuery on /aws/cleanrooms log groups and logs:GetQueryResults. ### Use cases - Let administrators set up and manage AWS Clean Rooms collaborations, configured tables and memberships, while preventing them from starting or updating protected queries. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It explicitly denies cleanrooms:StartProtectedQuery and cleanrooms:UpdateProtectedQuery, but it still allows cleanrooms:GetProtectedQuery and cleanrooms:ListProtectedQueries, so principals can view protected queries. - It can create and delete collaborations, configured tables and memberships on all resources, and pass roles with cleanrooms in the name to the AWS Clean Rooms service. Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Clean Rooms User Guide says you can attach it to your IAM principals. It fits where collaboration administration without querying is intended. ### FAQs **When should I attach AWSCleanRoomsFullAccessNoQuerying?** The AWS Clean Rooms User Guide says you can attach AWSCleanRoomsFullAccessNoQuerying to your IAM principals, and that it grants administrative permissions for full access to resources and metadata in a collaboration while excluding queries. Attach it for administrators who manage collaborations but should not run queries. **What does AWSCleanRoomsFullAccessNoQuerying grant?** It allows 46 cleanrooms actions on all resources, passing service roles named with cleanrooms to AWS Clean Rooms, reading AWS Glue metadata and managing CloudWatch Logs delivery. It explicitly denies cleanrooms:StartProtectedQuery and cleanrooms:UpdateProtectedQuery. **What are the security risks of AWSCleanRoomsFullAccessNoQuerying?** It can create, update and delete collaborations, configured tables and memberships, and pass service roles. The deny covers only two protected query actions; viewing protected queries is still allowed. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSCleanRoomsFullAccessNoQuerying (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsFullAccessNoQuerying.md), retrieved 2026-11-13 - [AWS managed policies for AWS Clean Rooms (AWS Clean Rooms User Guide)](https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSCleanRoomsReadOnlyAccess - Page: https://iampolicymap.com/policies/awscleanroomsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCleanRoomsReadOnlyAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: analyst. Distinct granted actions: 61 control plane, 0 data plane, 1 unclassified. - AWS description: Allows read-only access to AWS Clean Rooms resources and read-only access to related AWS Glue and Amazon CloudWatch Logs resources. - Actions: https://iampolicymap.com/policies/awscleanroomsreadonlyaccess/actions.json ### Tier reasons - Grants read access plus query or analysis actions that expose data. ### Summary Allows read-only access to AWS Clean Rooms resources and read-only access to related AWS Glue and Amazon CloudWatch Logs resources. The AWS Clean Rooms User Guide says it grants read-only permissions to resources and metadata in a collaboration. ### Practical scope Four statements. CleanRoomsRead allows cleanrooms:BatchGet*, cleanrooms:Get* and cleanrooms:List* on Resource "*". ConsoleDisplayTables allows nine read-only glue actions (glue:GetDatabase, glue:GetDatabases, glue:GetTable, glue:GetTables, glue:GetPartition, glue:GetPartitions, glue:GetSchema, glue:GetSchemaVersion and glue:BatchGetPartition). ConsoleLogSummaryQueryLogs allows logs:StartQuery on log groups whose names start with /aws/cleanrooms. ConsoleLogSummaryObtainLogs allows logs:GetQueryResults. ### Use cases - Let users or roles view AWS Clean Rooms collaborations and their metadata, including the AWS Glue table details and query logs the console shows, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no cleanrooms write actions, but cleanrooms:Get* and cleanrooms:List* apply to all resources. It also allows logs:StartQuery on /aws/cleanrooms log groups and logs:GetQueryResults on all resources, so principals can run log queries and retrieve results. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Clean Rooms User Guide says you can attach it to your IAM principals. It fits where read-only access to AWS Clean Rooms is intended. ### FAQs **When should I attach AWSCleanRoomsReadOnlyAccess?** The AWS Clean Rooms User Guide says you can attach AWSCleanRoomsReadOnlyAccess to your IAM principals, and that it grants read-only permissions to resources and metadata in a collaboration. Attach it where viewing AWS Clean Rooms is the intended scope. **What does AWSCleanRoomsReadOnlyAccess grant?** It allows cleanrooms:BatchGet*, cleanrooms:Get* and cleanrooms:List* on all resources, nine read-only glue actions, logs:StartQuery on log groups starting with /aws/cleanrooms and logs:GetQueryResults. **What are the security risks of AWSCleanRoomsReadOnlyAccess?** It grants no cleanrooms write actions, but its read access applies to all resources and it can run and read CloudWatch Logs queries. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSCleanRoomsReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCleanRoomsReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Clean Rooms (AWS Clean Rooms User Guide)](https://docs.aws.amazon.com/clean-rooms/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSCloudFormationFullAccess - Page: https://iampolicymap.com/policies/awscloudformationfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCloudFormationFullAccess` - Kind: standard. Domain: management-governance. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 104 control plane, 0 data plane, 3 unclassified. - AWS description: Provides full access to AWS CloudFormation. - Actions: https://iampolicymap.com/policies/awscloudformationfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: cloudformation (45 of 45). ### Summary Provides full access to AWS CloudFormation. The AWS CloudFormation User Guide says it grants permissions for full access to CloudFormation actions and resources. ### Practical scope The policy has one Allow statement: cloudformation:* on Resource "*". ### Use cases - Give users, groups or roles full access to CloudFormation actions and resources. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS CloudFormation User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - cloudformation:* allows every CloudFormation action on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full CloudFormation access is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AWSCloudFormationFullAccess?** The AWS CloudFormation User Guide says you can attach it to users, groups and roles, and that it grants full access to CloudFormation actions and resources. Attach it where that scope is intended. If you need less, AWS recommends customer managed policies specific to your use cases. **What does AWSCloudFormationFullAccess grant?** It allows cloudformation:* on all resources and nothing else. The User Guide says principals can perform all CloudFormation actions on all resources. **What are the security risks of AWSCloudFormationFullAccess?** cloudformation:* allows every CloudFormation action on all resources. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSCloudFormationFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCloudFormationFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS CloudFormation (AWS CloudFormation User Guide)](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSCloudFormationReadOnlyAccess - Page: https://iampolicymap.com/policies/awscloudformationreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 57 control plane, 0 data plane, 0 unclassified. - AWS description: Provides access to AWS CloudFormation via the AWS Management Console. - Actions: https://iampolicymap.com/policies/awscloudformationreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides access to AWS CloudFormation via the AWS Management Console. The AWS CloudFormation User Guide says it grants read-only access to CloudFormation resources and actions: describing stacks, listing resources and viewing templates, but not creating, updating or deleting stacks. ### Practical scope One Allow statement on Resource "*" with seven cloudformation: patterns: Describe*, BatchDescribe*, EstimateTemplateCost, Get*, List*, ValidateTemplate and Detect*. ### Use cases - Give users read-only access to CloudFormation stacks, resources and templates without the ability to create, update or delete stacks. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS CloudFormation User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows only read-style cloudformation: actions, but on all resources, and the User Guide says principals can view templates. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only CloudFormation access is intended. ### FAQs **When should I attach AWSCloudFormationReadOnlyAccess?** The AWS CloudFormation User Guide says it grants read-only access to CloudFormation resources and actions, such as describing stacks, listing resources and viewing templates, without allowing stacks to be created, updated or deleted. Attach it to people who need to look but not change. **What does AWSCloudFormationReadOnlyAccess grant?** It allows cloudformation:Describe*, BatchDescribe*, EstimateTemplateCost, Get*, List*, ValidateTemplate and Detect* on all resources. **What are the security risks of AWSCloudFormationReadOnlyAccess?** The policy does not allow creating, updating or deleting stacks, but its Get* and List* wildcards apply to all resources and the User Guide says principals can view templates. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSCloudFormationReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCloudFormationReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS CloudFormation (AWS CloudFormation User Guide)](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSCloudMapFullAccess - Page: https://iampolicymap.com/policies/awscloudmapfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCloudMapFullAccess` - Kind: standard. Domain: networking-content-delivery. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 43 control plane, 2 data plane, 4 unclassified. - AWS description: Provides full access to all AWS Cloud Map actions. - Actions: https://iampolicymap.com/policies/awscloudmapfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: servicediscovery (17 of 17). ### Summary Provides full access to all AWS Cloud Map actions. The AWS Cloud Map Developer Guide says you can attach it to your IAM entities. ### Practical scope One statement allows servicediscovery:* and a set of related actions on Resource "*", with no Condition: route53:GetHostedZone, route53:ListHostedZonesByName, route53:CreateHostedZone, route53:DeleteHostedZone, route53:ChangeResourceRecordSets, route53:CreateHealthCheck, route53:GetHealthCheck, route53:DeleteHealthCheck, route53:UpdateHealthCheck, ec2:DescribeVpcs, ec2:DescribeRegions and ec2:DescribeInstances. ### Use cases - Use all AWS Cloud Map actions. The policy also allows the Route 53 hosted zone and health check actions listed above. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - servicediscovery:* allows every AWS Cloud Map action on all resources. - The policy allows route53:ChangeResourceRecordSets, route53:DeleteHostedZone and route53:CreateHostedZone on all resources, so it can change or remove any hosted zone in the account, not only Cloud Map ones. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full AWS Cloud Map access is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AWSCloudMapFullAccess?** The AWS Cloud Map Developer Guide says you can attach it to your IAM entities and that it provides full access to all AWS Cloud Map actions. Attach it where that scope is intended. **What does AWSCloudMapFullAccess grant?** It allows servicediscovery:* on all resources, plus Route 53 hosted zone, record and health check actions and three EC2 describe actions. **What are the security risks of AWSCloudMapFullAccess?** servicediscovery:* allows every Cloud Map action, and the Route 53 actions are on all resources, including route53:DeleteHostedZone and route53:ChangeResourceRecordSets. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSCloudMapFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCloudMapFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Cloud Map (AWS Cloud Map Developer Guide)](https://docs.aws.amazon.com/cloud-map/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSCodePipeline_ReadOnlyAccess - Page: https://iampolicymap.com/policies/awscodepipeline_readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSCodePipeline_ReadOnlyAccess` - Kind: standard. Domain: developer-tools. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 14 control plane, 2 data plane, 0 unclassified. - AWS description: Provides read only access to AWS CodePipeline via the AWS Management Console. - Actions: https://iampolicymap.com/policies/awscodepipeline_readonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to AWS CodePipeline via the AWS Management Console, as the AWS Managed Policy Reference Guide describes it. ### Practical scope One statement allows, on Resource "*", codepipeline:GetPipeline, GetPipelineState, GetPipelineExecution, ListPipelineExecutions, ListActionExecutions, ListActionTypes, ListPipelines and ListTagsForResource, s3:ListAllMyBuckets, and codestar-notifications:ListNotificationRules, ListEventTypes and ListTargets. A second statement allows s3:GetObject, s3:ListBucket and s3:GetBucketPolicy on arn:aws:s3::*:codepipeline-*. A third allows codestar-notifications:DescribeNotificationRule when codestar-notifications:NotificationsForResource matches arn:aws:codepipeline:*. ### Use cases - View CodePipeline pipelines, their state and executions, and their notification rules from the AWS Management Console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - s3:GetObject is allowed on arn:aws:s3::*:codepipeline-*, so object contents matching that ARN pattern are readable. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where viewing CodePipeline is the only requirement. ### FAQs **When should I attach AWSCodePipeline_ReadOnlyAccess?** The reference page describes it as read only access to AWS CodePipeline via the AWS Management Console, and says you can attach it to users, groups and roles. Use it for people who only need to view pipelines. **What does AWSCodePipeline_ReadOnlyAccess grant?** It allows eight codepipeline read actions, s3:ListAllMyBuckets and three CodeStar Notifications list actions on all resources, s3:GetObject, s3:ListBucket and s3:GetBucketPolicy on codepipeline-* buckets, and codestar-notifications:DescribeNotificationRule for CodePipeline notification rules. **What are the security risks of AWSCodePipeline_ReadOnlyAccess?** The permissions are reads, but s3:GetObject applies to the arn:aws:s3::*:codepipeline-* pattern, so object contents matching it are readable. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSCodePipeline_ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSCodePipeline_ReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSDataExchangeReadOnly - Page: https://iampolicymap.com/policies/awsdataexchangereadonly/ - ARN: `arn:aws:iam::aws:policy/AWSDataExchangeReadOnly` - Kind: standard. Domain: analytics. Default version: v4. Guide reviewed against: v4. - Tier: reader. Distinct granted actions: 28 control plane, 0 data plane, 4 unclassified. - AWS description: Grants read-only access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. - Actions: https://iampolicymap.com/policies/awsdataexchangereadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Grants read-only access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. The AWS Data Exchange User Guide describes it the same way. ### Practical scope Two Allow statements on Resource "*". The first allows 15 dataexchange: Get and List actions, including GetAsset, GetDataSet, GetJob, GetRevision, GetDataGrant, GetReceivedDataGrant, ListDataSets, ListDataGrants, ListReceivedDataGrants, ListRevisionAssets and ListTagsForResource. The second allows 13 aws-marketplace: actions such as ViewSubscriptions, SearchAgreements, GetAgreementTerms, GetAgreementRequest, ListAgreementRequests, GetAgreementApprovalRequest, ListAgreementApprovalRequests, DescribeEntity, ListEntities, DescribeChangeSet, ListChangeSets, ListPrivateListings and ListTagsForResource. ### Use cases - Give users read-only access to AWS Data Exchange data sets, revisions, assets, jobs and data grants, and to related AWS Marketplace subscriptions and agreements, without the ability to change them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Data Exchange User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows only Get, List, Describe, Search and View actions, but on all resources, including data set assets (dataexchange:GetAsset) and agreement terms (aws-marketplace:GetAgreementTerms). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only AWS Data Exchange access is intended. ### FAQs **When should I attach AWSDataExchangeReadOnly?** The AWS Data Exchange User Guide says it grants read-only access to AWS Data Exchange and AWS Marketplace actions using the AWS Management Console and SDK. Attach it to users, groups or roles that should view but not change Data Exchange resources. **What does AWSDataExchangeReadOnly grant?** It allows dataexchange: get and list actions for assets, data sets, revisions, jobs, event actions, data grants and tags, and aws-marketplace: view, get, list, describe and search actions for subscriptions, agreements, entities, change sets and private listings, all on all resources. **What are the security risks of AWSDataExchangeReadOnly?** The policy has no write actions, but its read actions apply to all resources. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSDataExchangeReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDataExchangeReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for AWS Data Exchange (AWS Data Exchange User Guide)](https://docs.aws.amazon.com/data-exchange/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSDataPipeline_PowerUser - Page: https://iampolicymap.com/policies/awsdatapipeline_poweruser/ - ARN: `arn:aws:iam::aws:policy/AWSDataPipeline_PowerUser` - Kind: standard. Domain: analytics. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 47 control plane, 3 data plane, 4 unclassified. - AWS description: Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles. - Actions: https://iampolicymap.com/policies/awsdatapipeline_poweruser/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: datapipeline (11 of 11). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Data Pipeline, list access for S3, DynamoDB, Redshift, RDS, SNS, and IAM roles, and passRole access for default Roles. ### Practical scope Two statements. The first allows twelve actions on Resource "*": datapipeline:*, s3:List*, dynamodb:DescribeTable, rds:DescribeDBInstances, rds:DescribeDBSecurityGroups, redshift:DescribeClusters, redshift:DescribeClusterSecurityGroups, sns:ListTopics, iam:ListRoles, iam:GetRolePolicy, iam:GetInstanceProfile and iam:ListInstanceProfiles. The second allows iam:PassRole on two roles only: DataPipelineDefaultResourceRole and DataPipelineDefaultRole. ### Use cases - Let users create and manage AWS Data Pipeline pipelines, with list and describe access to related services, and permission to pass the two default Data Pipeline roles. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - datapipeline:* on all resources gives full control of Data Pipeline. iam:PassRole is limited to DataPipelineDefaultResourceRole and DataPipelineDefaultRole, so a principal can configure pipelines to run with whatever permissions those two roles hold. - Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - It also includes iam:GetRolePolicy and iam:GetInstanceProfile on all resources, which let a principal read role policy details. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where building and running Data Pipeline pipelines is intended. ### FAQs **When should I attach AWSDataPipeline_PowerUser?** The reference page says you can attach AWSDataPipeline_PowerUser to your users, groups and roles, and describes it as full access to Data Pipeline with list access to related services and passRole for the default roles. Attach it for people who build and run pipelines. **What does AWSDataPipeline_PowerUser grant?** It allows datapipeline:* plus eleven list, describe and get actions for S3, DynamoDB, Redshift, RDS, SNS and IAM on all resources, and iam:PassRole on DataPipelineDefaultResourceRole and DataPipelineDefaultRole. **What are the security risks of AWSDataPipeline_PowerUser?** datapipeline:* gives full control of Data Pipeline, and iam:PassRole on the two default roles means pipelines can run with whatever permissions those roles hold. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSDataPipeline_PowerUser (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDataPipeline_PowerUser.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSDirectoryServiceDataReadOnlyAccess - Page: https://iampolicymap.com/policies/awsdirectoryservicedatareadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSDirectoryServiceDataReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 9 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read-only access to AWS Directory Service Data - Actions: https://iampolicymap.com/policies/awsdirectoryservicedatareadonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Provides read-only access to AWS Directory Service Data. The Directory Service Administration Guide says it lets principals view and search Active Directory objects within managed directories. ### Practical scope The policy has one statement, DSDataReadOnlyAccess, on Resource "arn:aws:ds:*:*:directory/*". It allows ds:AccessDSData, ds-data:DescribeGroup, ds-data:DescribeUser, ds-data:ListGroupMembers, ds-data:ListGroups, ds-data:ListGroupsForMember, ds-data:ListUsers, ds-data:SearchGroups and ds-data:SearchUsers. It has no create, update or delete actions. ### Use cases - Let a user or group view and search Active Directory users, groups and group memberships in managed directories without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The Directory Service Administration Guide says principals cannot make any updates to users, groups or group memberships. Principals can still search for users and groups, view user and group details and list group memberships across all directories matching arn:aws:ds:*:*:directory/*. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Directory Service Administration Guide says you can attach it to your IAM identities. It fits where read-only access to directory users and groups is intended. ### FAQs **When should I attach AWSDirectoryServiceDataReadOnlyAccess?** The Directory Service Administration Guide says you can attach it to your IAM identities, and that it allows a user or group to view and search Active Directory users, members and groups. Attach it where read-only access to directory objects is the intended scope. **What does AWSDirectoryServiceDataReadOnlyAccess grant?** It allows ds:AccessDSData and the read actions ds-data:DescribeGroup, DescribeUser, ListGroupMembers, ListGroups, ListGroupsForMember, ListUsers, SearchGroups and SearchUsers on directory ARNs (arn:aws:ds:*:*:directory/*). Principals cannot create, modify or delete users, groups or group memberships. **What are the security risks of AWSDirectoryServiceDataReadOnlyAccess?** It lets principals search and read user and group details and group memberships across directories matching arn:aws:ds:*:*:directory/*, and the Directory Service Administration Guide says they cannot update any of them. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSDirectoryServiceDataReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDirectoryServiceDataReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Directory Service](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSDirectoryServiceFullAccess - Page: https://iampolicymap.com/policies/awsdirectoryservicefullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSDirectoryServiceFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v6. Guide reviewed against: v6. - Tier: admin. Distinct granted actions: 124 control plane, 0 data plane, 11 unclassified. - AWS description: Provides full access to AWS Directory Service. - Actions: https://iampolicymap.com/policies/awsdirectoryservicefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: ds (60 of 60). ### Summary Provides full access to AWS Directory Service. The Directory Service Administration Guide says principals can create, configure and manage directories, including Simple AD, AD Connector and Managed Microsoft AD. ### Practical scope The first statement, DirectoryServiceFullAccess, allows ds:* plus listed actions for EC2 (network interfaces, security groups, subnets and VPCs), SNS (topic and subscription reads), iam:ListRoles and AWS Organizations (list and describe actions) on Resource "*". DirectoryServiceEventTopic allows sns:CreateTopic, sns:DeleteTopic, sns:SetTopicAttributes, sns:Subscribe and sns:Unsubscribe on topics named DirectoryMonitoring*. DirectoryServiceOrganizations allows organizations:EnableAWSServiceAccess and organizations:DisableAWSServiceAccess only when organizations:ServicePrincipal is ds.amazonaws.com. DirectoryServiceTags allows ec2:CreateTags and ec2:DeleteTags on network interfaces and security groups. ### Use cases - Give administrators full access to AWS Directory Service, including the network resources that directories need. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - ds:* allows every Directory Service action on all resources. The Directory Service Administration Guide says this includes managing directory sharing, trust relationships and monitoring configurations. - The EC2 actions on Resource "*" include ec2:AuthorizeSecurityGroupIngress, ec2:AuthorizeSecurityGroupEgress, ec2:RevokeSecurityGroupIngress, ec2:CreateSecurityGroup, ec2:DeleteSecurityGroup and ec2:DeleteNetworkInterface. - The policy can enable and disable AWS service access for Directory Service in AWS Organizations (organizations:EnableAWSServiceAccess and organizations:DisableAWSServiceAccess). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Directory Service Administration Guide says you can attach it to your IAM identities. It fits where full administrative access to Directory Service is intended. ### FAQs **When should I attach AWSDirectoryServiceFullAccess?** The Directory Service Administration Guide says you can attach it to your IAM identities, and that it grants administrative permissions with full access to all Directory Service actions. Attach it where that administrative scope is intended. **What does AWSDirectoryServiceFullAccess grant?** It allows ds:*, EC2 network and security group actions, SNS topic reads, iam:ListRoles and Organizations list and describe actions on all resources, SNS topic management for topics named DirectoryMonitoring*, enabling and disabling Directory Service access in Organizations, and tagging of network interfaces and security groups. **What are the security risks of AWSDirectoryServiceFullAccess?** ds:* covers every Directory Service action on all resources, the EC2 actions let a principal change security group rules, and the Organizations statement can enable or disable service access. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSDirectoryServiceFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDirectoryServiceFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Directory Service](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSDirectoryServiceReadOnlyAccess - Page: https://iampolicymap.com/policies/awsdirectoryservicereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSDirectoryServiceReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v4. Guide reviewed against: v4. - Tier: reader. Distinct granted actions: 39 control plane, 0 data plane, 3 unclassified. - AWS description: Provides read only access to AWS Directory Service. - Actions: https://iampolicymap.com/policies/awsdirectoryservicereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to AWS Directory Service. The Directory Service Administration Guide says principals cannot make any updates to directories or their configurations. ### Practical scope One statement on Resource "*" allows ds:Check*, ds:Describe*, ds:Get*, ds:List* and ds:Verify*, plus ec2:DescribeNetworkInterfaces, ec2:DescribeSubnets, ec2:DescribeVpcs, sns:ListTopics, sns:GetTopicAttributes, sns:ListSubscriptions, sns:ListSubscriptionsByTopic, organizations:DescribeAccount, organizations:DescribeOrganization and organizations:ListAWSServiceAccessForOrganization. It has no create, update or delete actions. ### Use cases - Let users view directory details, trust relationships and monitoring configurations, and the related EC2 network resources and SNS topics, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources and also reads EC2 network resources, SNS topics and subscriptions, and AWS Organizations account and service access information. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Directory Service Administration Guide says you can attach it to your IAM identities. It fits where read-only access to Directory Service is intended. ### FAQs **When should I attach AWSDirectoryServiceReadOnlyAccess?** The Directory Service Administration Guide says you can attach it to your IAM identities and that it allows users to view information in Directory Service. Attach it where viewing directories is the intended scope. **What does AWSDirectoryServiceReadOnlyAccess grant?** It allows ds:Check*, ds:Describe*, ds:Get*, ds:List* and ds:Verify*, three EC2 describe actions, four SNS read actions and three Organizations read actions on all resources. Principals cannot create new directories or modify existing ones. **What are the security risks of AWSDirectoryServiceReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and covers EC2, SNS and Organizations reads as well as Directory Service. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSDirectoryServiceReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDirectoryServiceReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Directory Service](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSElasticDisasterRecoveryReadOnlyAccess - Page: https://iampolicymap.com/policies/awselasticdisasterrecoveryreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess` - Kind: standard. Domain: migration-transfer. Default version: v6. Guide reviewed against: v6. - Tier: reader. Distinct granted actions: 32 control plane, 0 data plane, 1 unclassified. - AWS description: You can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities. This policy provides permissions to all read-only public APIs of Elastic Disaster Recovery (DRS), as well as some read-only APIs of other AWS service… - Actions: https://iampolicymap.com/policies/awselasticdisasterrecoveryreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides permissions to all read-only public APIs of AWS Elastic Disaster Recovery (DRS), plus some read-only APIs of other AWS services needed to make full read-only use of the DRS console. The DRS User Guide says it suits team members who need visibility into a disaster recovery setup, such as auditors or monitoring teams, without the ability to make changes. ### Practical scope 8 statements, all Allow. 21 drs actions (Describe, Get and List actions, including recovery plan and recovery plan execution actions) and five EC2 read actions (ec2:DescribeInstances, ec2:DescribeLaunchTemplateVersions, ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:GetInstanceTypesFromInstanceRequirements) are on Resource "*", as are iam:ListRoles and ssm:ListCommandInvocations. ssm:GetParameter is limited to ARNs matching arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*. ssm:DescribeDocument and ssm:GetDocument cover 8 listed SSM document ARNs. ssm:GetAutomationExecution is on arn:aws:ssm:*:*:automation-execution/* with a Null condition on aws:ResourceTag/AWSElasticDisasterRecoveryManaged set to "false". ### Use cases - Give auditors, monitoring teams or other users view-only access to AWS Elastic Disaster Recovery resources and the DRS console. ### Prerequisites None. ### Best practices - The DRS User Guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - It reaches beyond DRS: 5 EC2 describe or get actions, iam:ListRoles, ssm:ListCommandInvocations and scoped SSM read actions are included so the console works, so principals can see instance, network and role details outside DRS. - ssm:GetParameter is allowed on parameters matching arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*, so principals can read the parameters under that name pattern. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The DRS User Guide says to attach it to your users or roles and that it is ideal for team members who need visibility into your disaster recovery setup without the ability to make changes. ### FAQs **When should I attach AWSElasticDisasterRecoveryReadOnlyAccess?** The reference page says you can attach AWSElasticDisasterRecoveryReadOnlyAccess to your users, groups and roles, and describes it as: you can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities and it provides permissions to all read-only public APIs of Elastic Disaster Recovery. Attach it where read-only visibility into Elastic Disaster Recovery is the intended scope. **What does AWSElasticDisasterRecoveryReadOnlyAccess grant?** It allows 21 drs read actions on all resources, 5 EC2 read actions, iam:ListRoles, ssm:ListCommandInvocations, and narrower SSM read actions on parameter, document and automation-execution ARNs. **What are the security risks of AWSElasticDisasterRecoveryReadOnlyAccess?** It has no drs write actions, but it includes read actions for EC2, IAM roles and SSM outside DRS, and ssm:GetParameter on parameters matching arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSElasticDisasterRecoveryReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSElasticDisasterRecoveryReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policy: AWSElasticDisasterRecoveryReadOnlyAccess](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol-AWSElasticDisasterRecoveryReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Elastic Disaster Recovery](https://docs.aws.amazon.com/drs/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSGlueConsoleFullAccess - Page: https://iampolicymap.com/policies/awsglueconsolefullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess` - Kind: standard. Domain: analytics. Default version: v15. Guide reviewed against: v15. - Tier: admin. Distinct granted actions: 352 control plane, 4 data plane, 60 unclassified. - AWS description: Provides full access to AWS Glue via the AWS Management Console - Actions: https://iampolicymap.com/policies/awsglueconsolefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: glue (184 of 184). - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to AWS Glue via the AWS Management Console. The AWS Glue Developer Guide says it grants full access to AWS Glue resources when an identity that the policy is attached to uses the console, and that you get full console capabilities if you follow the naming convention for resources in the policy. ### Practical scope Twelve statements. The first allows 37 actions on Resource "*": glue:* plus read actions for redshift, iam (list and get roles and role policies, list users and groups), ec2, rds, s3 (including s3:ListAllMyBuckets), cloudformation, dynamodb, kms, cloudwatch and databrew. Scoped statements allow s3:GetObject and s3:PutObject on the resource patterns arn:aws:s3:::aws-glue-*/*, arn:aws:s3:::*/*aws-glue-*/* and arn:aws:s3:::aws-glue-*, s3:CreateBucket on arn:aws:s3:::aws-glue-*, logs:GetLogEvents on /aws-glue/ log groups, cloudformation:CreateStack and cloudformation:DeleteStack on aws-glue* stacks, ec2:RunInstances on instance, key-pair, image, security-group, network-interface, subnet and volume resources, and ec2:TerminateInstances, ec2:CreateTags and ec2:DeleteTags on instances tagged ZeppelinInstance in aws-glue stacks. Three statements allow iam:PassRole on roles named AWSGlueServiceRole* and AWSGlueServiceNotebookRole*, only when passed to glue.amazonaws.com or ec2.amazonaws.com. ### Use cases - Let AWS Glue console users build and manage AWS Glue resources when resources follow the naming convention in the policy. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - glue:* on all resources gives full control of AWS Glue, and the policy also lets a principal create and delete CloudFormation stacks named aws-glue* and launch EC2 instances. - The S3 object resource pattern arn:aws:s3:::*/*aws-glue-*/* is not limited to buckets named aws-glue-*, so s3:GetObject and s3:PutObject reach objects in any bucket, for object keys that have an aws-glue- path segment. - It includes iam:PassRole for roles named AWSGlueServiceRole* and AWSGlueServiceNotebookRole*, limited by an iam:PassedToService condition. Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Glue Developer Guide says AWS managed policies for AWS Glue can be attached to identities in your account, and that AWSGlueConsoleFullAccess is typically attached to users of the AWS Glue console. It fits where full use of the Glue console is intended. ### FAQs **When should I attach AWSGlueConsoleFullAccess?** The AWS Glue Developer Guide says AWSGlueConsoleFullAccess is typically attached to users of the AWS Glue console and grants full console capabilities if you follow the naming convention for resources in the policy. Attach it to identities that need to build and manage Glue resources in the console. **What does AWSGlueConsoleFullAccess grant?** It allows glue:* on all resources plus read actions for many related services, s3:GetObject and s3:PutObject on three aws-glue-* resource patterns (one matches any bucket, for object keys with an aws-glue- path segment), CloudFormation stack create and delete on aws-glue* stacks, EC2 instance launch and iam:PassRole for AWSGlueServiceRole* and AWSGlueServiceNotebookRole* roles. **What are the security risks of AWSGlueConsoleFullAccess?** glue:* on all resources gives full control of AWS Glue. The policy can also create and delete aws-glue* CloudFormation stacks, launch EC2 instances and pass the named service roles. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSGlueConsoleFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSGlueConsoleFullAccess.md), retrieved 2026-11-13 - [Granting AWS managed policies for AWS Glue (AWS Glue Developer Guide)](https://docs.aws.amazon.com/glue/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSGlueConsoleSageMakerNotebookFullAccess - Page: https://iampolicymap.com/policies/awsglueconsolesagemakernotebookfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSGlueConsoleSageMakerNotebookFullAccess` - Kind: standard. Domain: analytics. Default version: v4. Guide reviewed against: v4. - Tier: admin. Distinct granted actions: 365 control plane, 4 data plane, 60 unclassified. - AWS description: Provides full access to AWS Glue via the AWS Management Console and access to sagemaker notebook instances. - Actions: https://iampolicymap.com/policies/awsglueconsolesagemakernotebookfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: glue (184 of 184). - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to AWS Glue via the AWS Management Console and access to sagemaker notebook instances. The AWS Glue Developer Guide says it grants full access to AWS Glue and SageMaker AI resources when used through the console. ### Practical scope Fifteen statements. The first allows 38 actions on Resource "*": glue:* plus read and network actions for redshift, iam, ec2 (including ec2:CreateNetworkInterface, ec2:AttachNetworkInterface and ec2:DeleteNetworkInterface), rds, s3, cloudformation, dynamodb, kms, cloudwatch and sagemaker:ListNotebookInstances. Scoped statements allow s3:GetObject and s3:PutObject on the resource patterns arn:aws:s3:::*/*aws-glue-*/* and arn:aws:s3:::aws-glue-*, s3:CreateBucket on arn:aws:s3:::aws-glue-*, cloudformation:CreateStack and cloudformation:DeleteStack on aws-glue* stacks, 8 sagemaker notebook instance actions (including create, start, stop and delete) on notebook instances named aws-glue-*, four notebook lifecycle configuration actions on configurations named aws-glue-*, and ec2:RunInstances. Four statements allow iam:PassRole on roles named AWSGlueServiceRole*, AWSGlueServiceNotebookRole* and AWSGlueServiceSageMakerNotebookRole*, only when passed to glue.amazonaws.com, ec2.amazonaws.com or sagemaker.amazonaws.com. ### Use cases - Let AWS Glue console users build Glue resources and create and manage SageMaker AI notebook instances named aws-glue-*, when resources follow the naming convention in the policy. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - glue:* on all resources gives full control of AWS Glue. The policy also lets a principal create, start, stop and delete SageMaker notebook instances named aws-glue-*, create and delete aws-glue* CloudFormation stacks and launch EC2 instances. - The S3 object resource pattern arn:aws:s3:::*/*aws-glue-*/* is not limited to buckets named aws-glue-*, so s3:GetObject and s3:PutObject reach objects in any bucket, for object keys that have an aws-glue- path segment. - It includes iam:PassRole for roles named AWSGlueServiceRole*, AWSGlueServiceNotebookRole* and AWSGlueServiceSageMakerNotebookRole*, limited by an iam:PassedToService condition. Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Glue Developer Guide says AWS managed policies for AWS Glue can be attached to identities in your account, and that this policy is typically attached to users of the AWS Glue console who manage SageMaker AI notebooks. It fits where that combination is intended. ### FAQs **When should I attach AWSGlueConsoleSageMakerNotebookFullAccess?** The AWS Glue Developer Guide says AWSGlueConsoleSageMakerNotebookFullAccess is typically attached to users of the AWS Glue console who manage SageMaker AI notebooks. Attach it to identities that need both, and consider AWSGlueConsoleFullAccess where notebooks are not needed. **What does AWSGlueConsoleSageMakerNotebookFullAccess grant?** It allows glue:* on all resources plus read and network actions for related services, s3:GetObject and s3:PutObject on two aws-glue-* resource patterns (one matches any bucket, for object keys with an aws-glue- path segment), SageMaker notebook instance and lifecycle configuration actions on aws-glue-* names, CloudFormation stack create and delete, EC2 instance launch and iam:PassRole for three AWSGlueService role name patterns. **What are the security risks of AWSGlueConsoleSageMakerNotebookFullAccess?** glue:* on all resources gives full control of AWS Glue, and the policy can create and delete SageMaker notebook instances, create CloudFormation stacks, launch EC2 instances and pass the named service roles. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSGlueConsoleSageMakerNotebookFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSGlueConsoleSageMakerNotebookFullAccess.md), retrieved 2026-11-13 - [Granting AWS managed policies for AWS Glue (AWS Glue Developer Guide)](https://docs.aws.amazon.com/glue/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSKeyManagementServicePowerUser - Page: https://iampolicymap.com/policies/awskeymanagementservicepoweruser/ - ARN: `arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser` - Kind: standard. Domain: security-identity-compliance. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 23 control plane, 0 data plane, 0 unclassified. - AWS description: Provides access to AWS Key Management Service (KMS). - Actions: https://iampolicymap.com/policies/awskeymanagementservicepoweruser/actions.json ### Tier reasons - Grants 6 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides access to AWS Key Management Service (KMS). The AWS KMS Developer Guide says it gives IAM principals the permissions of a power user: they can create KMS keys, use and manage the KMS keys they create, and view all KMS keys and IAM identities. ### Practical scope The policy allows kms:CreateAlias, kms:CreateKey, kms:DeleteAlias, kms:Describe*, kms:GenerateRandom, kms:Get*, kms:List*, kms:TagResource and kms:UntagResource, plus iam:ListGroups, iam:ListRoles and iam:ListUsers, on Resource "*". It does not allow principals to use or manage KMS keys that they didn't create. Principals with this policy can also get permissions from other sources, including key policies, other IAM policies and grants. ### Use cases - Give a principal the permissions of a KMS power user: creating KMS keys, managing aliases and tags, and viewing all KMS keys and IAM users, groups and roles. ### Prerequisites - Permissions that are specific to a KMS key, such as kms:TagResource and kms:GetKeyRotationStatus, are effective only when the key policy for that KMS key explicitly allows the AWS account to use IAM policies to control access to the key. - To view the AWS KMS console without errors, the principal needs tag:GetResources, which is not included in this policy. You can allow it in a separate IAM policy. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - Creating a KMS key includes setting the key policy, so power users can give themselves and others permission to use and manage the KMS keys they create. - The policy allows creating and deleting aliases and tags on all KMS keys. Changing a tag or alias can allow or deny permission to use and manage the KMS key. - The policy gives a power user permissions on any KMS key with a key policy that permits the operation. For cross-account permissions such as kms:DescribeKey and kms:ListGrants, this might include KMS keys in untrusted AWS accounts. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It is intended to give IAM principals in your account the permissions of a KMS power user. It leaves out tag:GetResources, so add that separately if the principal needs the KMS console. ### FAQs **When should I attach AWSKeyManagementServicePowerUser?** Attach it to IAM principals in your account who should have the permissions of a KMS power user: creating KMS keys, using and managing the keys they create, and viewing all KMS keys and IAM identities. Key-specific permissions take effect only when the key policy explicitly allows the account to use IAM policies to control access to the key. **What does AWSKeyManagementServicePowerUser grant?** On all resources it allows kms:CreateAlias, kms:CreateKey, kms:DeleteAlias, kms:Describe*, kms:GenerateRandom, kms:Get*, kms:List*, kms:TagResource and kms:UntagResource, plus iam:ListGroups, iam:ListRoles and iam:ListUsers. It does not allow principals to use or manage KMS keys that they didn't create. **What are the security risks of AWSKeyManagementServicePowerUser?** Because creating a key includes setting its key policy, power users can give themselves and others permission to use and manage keys they create. They can also change aliases and tags on all KMS keys, which can allow or deny permission to use and manage a key. For cross-account permissions the policy might reach KMS keys in untrusted AWS accounts. ### Sources - [AWSKeyManagementServicePowerUser (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSKeyManagementServicePowerUser.md), retrieved 2026-11-12 - [AWS managed policies for AWS Key Management Service (AWS KMS Developer Guide)](https://docs.aws.amazon.com/kms/latest/developerguide/security-iam-awsmanpol.md), retrieved 2026-11-12 ## AWSLambdaFullAccess - Page: https://iampolicymap.com/policies/awslambdafullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSLambdaFullAccess` - Kind: standard. Domain: privileged. Default version: v8. Guide reviewed against: v8. - Tier: admin; High privilege. Distinct granted actions: 750 control plane, 68 data plane, 126 unclassified. - AWS description: This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/lambda/latest/dg/access-control-identity-based.html. Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs. - Actions: https://iampolicymap.com/policies/awslambdafullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: cloudwatch (89 of 89), dynamodb (45 of 45), events (45 of 45), lambda (76 of 76), logs (70 of 70), s3 (84 of 84). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole on all resources without conditions. - 27 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Lambda, S3, DynamoDB, CloudWatch Metrics and Logs. AWS says this policy is on a deprecation path and points to the Lambda documentation for guidance. ### Practical scope One statement allows, on Resource "*" with no Condition, lambda:*, s3:*, dynamodb:*, cloudwatch:*, logs:* and events:*, iam:PassRole, and read actions for IAM roles and policies (iam:GetPolicy, iam:GetPolicyVersion, iam:GetRole, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:ListRolePolicies and iam:ListRoles). It also allows IoT actions (including iot:CreateKeysAndCertificate, iot:CreatePolicy, iot:AttachPrincipalPolicy and iot:ReplaceTopicRule), sns:Publish, sns:Subscribe and sns:Unsubscribe, sqs:SendMessage, kinesis:PutRecord, cognito-sync:SetCognitoEvents, X-Ray telemetry writes, and describe, list and get actions for CloudFormation, EC2, Cognito, KMS, SNS, SQS, Kinesis and tagging. ### Use cases - Use Lambda together with S3, DynamoDB, CloudWatch Metrics and CloudWatch Logs, with full access to those services. AWS says the policy is on a deprecation path, so check the Lambda documentation it links to before using it for new work. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - lambda:*, s3:*, dynamodb:*, cloudwatch:*, logs:* and events:* allow every action in those services on all resources. - iam:PassRole is allowed on all resources with no iam:PassedToService condition. The IAM User Guide says a user needs permission to pass a role to an AWS service before the service can be configured with it. - The IoT actions include iot:CreateKeysAndCertificate, iot:CreatePolicy and iot:AttachPrincipalPolicy. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS marks this policy as being on a deprecation path, so check the guidance it links to before using it in a new permission set. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AWSLambdaFullAccess?** AWS says this policy is on a deprecation path and links to the Lambda documentation for guidance, so review that page before attaching it. The policy is meant for users, groups or roles that need full Lambda access together with S3, DynamoDB, CloudWatch Logs and EventBridge. **What does AWSLambdaFullAccess grant?** It allows lambda:*, s3:*, dynamodb:*, cloudwatch:*, logs:* and events:* on all resources, iam:PassRole, read access to IAM roles and policies, IoT, SNS, SQS, Kinesis and Cognito Sync actions, and X-Ray telemetry writes. **What are the security risks of AWSLambdaFullAccess?** It combines wildcard access to several data services with iam:PassRole on all resources and no service condition, plus IoT credential and policy actions. AWS says the policy is on a deprecation path. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSLambdaFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambdaFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AWSLambda_FullAccess - Page: https://iampolicymap.com/policies/awslambda_fullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSLambda_FullAccess` - Kind: standard. Domain: serverless. Default version: v7. Guide reviewed against: v7. - Tier: admin. Distinct granted actions: 146 control plane, 18 data plane, 9 unclassified. - AWS description: Grants full access to AWS Lambda service, AWS Lambda console features, and other related AWS services. - Actions: https://iampolicymap.com/policies/awslambda_fullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: lambda (76 of 76). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Grants full access to the AWS Lambda service, AWS Lambda console features, and other related AWS services. AWS says it grants full access to Lambda actions and permissions to other AWS services used to develop and maintain Lambda resources. ### Practical scope The first statement allows lambda:* plus describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray, on Resource "*". iam:PassRole is allowed on Resource "*" only when iam:PassedToService equals lambda.amazonaws.com. Log reads such as logs:GetLogEvents and logs:StartLiveTail are limited to log groups matching arn:aws:logs:*:*:log-group:/aws/lambda/*. iam:CreateServiceLinkedRole is limited to the AWSServiceRoleForLambda role. ### Use cases - Develop and maintain Lambda functions from the console, including assigning an execution role to a function (the PassRole permission is used when you assign an execution role to a function). ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - lambda:* allows every Lambda action on all resources. iam:PassRole on Resource "*" is limited by condition to roles passed to lambda.amazonaws.com, which is the permission used when you assign an execution role to a function. - The policy also grants read access to IAM roles and policies (iam:GetRole, iam:GetRolePolicy, iam:ListRoles and related actions) on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full Lambda access is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AWSLambda_FullAccess?** The AWS Lambda Developer Guide says you can attach it to your users, groups and roles and that it grants full access to Lambda actions and related services used to develop and maintain Lambda resources. Attach it where that is the intended scope, and use a customer managed policy if you need less. **What does AWSLambda_FullAccess grant?** It allows lambda:* and a set of describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray, plus iam:PassRole to lambda.amazonaws.com and log reads on /aws/lambda/* log groups. **What are the security risks of AWSLambda_FullAccess?** lambda:* allows every Lambda action on all resources, and the policy lets a user pass roles to Lambda when assigning execution roles. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSLambda_FullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambda_FullAccess.md), retrieved 2026-11-12 - [AWS managed policies for AWS Lambda (AWS Lambda Developer Guide)](https://docs.aws.amazon.com/lambda/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSLambda_ReadOnlyAccess - Page: https://iampolicymap.com/policies/awslambda_readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess` - Kind: standard. Domain: serverless. Default version: v5. Guide reviewed against: v5. - Tier: analyst. Distinct granted actions: 85 control plane, 5 data plane, 2 unclassified. - AWS description: Grants read-only access to AWS Lambda service, AWS Lambda console features, and other related AWS services. - Actions: https://iampolicymap.com/policies/awslambda_readonlyaccess/actions.json ### Tier reasons - Grants read access plus query or analysis actions that expose data. ### Summary Grants read-only access to the AWS Lambda service, AWS Lambda console features, and other related AWS services. AWS says it grants read-only access to Lambda resources and to other services used to develop and maintain Lambda resources. ### Practical scope The first statement allows lambda:Get* and lambda:List* plus describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray, on Resource "*". A second statement allows log actions such as logs:GetLogEvents, logs:FilterLogEvents, logs:StartQuery and logs:StartLiveTail only on log groups matching arn:aws:logs:*:*:log-group:/aws/lambda/*. The policy has no lambda create, update or delete action. ### Use cases - View Lambda resources and the related CloudFormation, CloudWatch, Amazon EC2, IAM, Step Functions and X-Ray information used to develop and maintain them, without changing anything. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy can read Lambda log data: logs:GetLogEvents, logs:FilterLogEvents, logs:StartQuery and logs:StartLiveTail on /aws/lambda/* log groups. - It also lets the user read IAM roles and policies (iam:GetRole, iam:GetRolePolicy, iam:ListRoles and related actions) on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Lambda is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AWSLambda_ReadOnlyAccess?** The AWS Lambda Developer Guide says you can attach it to your users, groups and roles and that it grants read-only access to Lambda resources and related services. Attach it where viewing Lambda is the intended scope. **What does AWSLambda_ReadOnlyAccess grant?** It allows lambda:Get* and lambda:List* and describe, list and get actions for CloudFormation, CloudWatch, Amazon EC2, AWS KMS, IAM, CloudWatch Logs, AWS Step Functions, tagging and AWS X-Ray on all resources, plus log reads and queries on /aws/lambda/* log groups. **What are the security risks of AWSLambda_ReadOnlyAccess?** It has no Lambda create, update or delete action, but it can read Lambda log data and IAM role and policy details. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSLambda_ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambda_ReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for AWS Lambda (AWS Lambda Developer Guide)](https://docs.aws.amazon.com/lambda/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSManagedControlPolicyManagementAccess - Page: https://iampolicymap.com/policies/awsmanagedcontrolpolicymanagementaccess/ - ARN: `arn:aws:iam::aws:policy/AWSManagedControlPolicyManagementAccess` - Kind: standard. Domain: privileged. Default version: v1. Guide reviewed against: v1. - Tier: operator; High privilege. Distinct granted actions: 11 control plane, 0 data plane, 0 unclassified. - AWS description: Grants AWS permission to manage organization control policies for AWS managed accounts - Actions: https://iampolicymap.com/policies/awsmanagedcontrolpolicymanagementaccess/actions.json ### Tier reasons - Grants 7 write, tagging or permissions-management actions, short of full control of any service. - Grants permissions-management actions on organizations on all resources without conditions. ### Summary Grants AWS permission to manage organization control policies for AWS managed accounts, according to the description on the reference page. ### Practical scope One statement allows organizations:DescribePolicy, organizations:UpdatePolicy, organizations:ListPolicies, organizations:ListRoots, organizations:CreatePolicy, organizations:AttachPolicy, organizations:DetachPolicy, organizations:DeletePolicy, organizations:TagResource, organizations:UntagResource and organizations:ListTagsForResource on Resource "*". ### Use cases - Let a principal create, update, attach, detach, delete, list and tag policies in AWS Organizations, for the organization control policies the description refers to. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows organizations:AttachPolicy, organizations:DetachPolicy, organizations:UpdatePolicy and organizations:DeletePolicy on Resource "*", so a principal with it can change and remove policies across the organization. - The description is worded as granting AWS permission. The reference page says you can attach it to your users, groups and roles, but the cached sources do not say which service uses it, so confirm the intended use before attaching it to a human identity. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The description says it grants AWS permission to manage organization control policies for AWS managed accounts. ### FAQs **When should I attach AWSManagedControlPolicyManagementAccess?** The reference page says you can attach it to your users, groups and roles. The description says it grants AWS permission to manage organization control policies for AWS managed accounts, so attach it only where managing those policies is the intended scope. **What does AWSManagedControlPolicyManagementAccess grant?** On all resources it allows organizations:DescribePolicy, UpdatePolicy, ListPolicies, ListRoots, CreatePolicy, AttachPolicy, DetachPolicy, DeletePolicy, TagResource, UntagResource and ListTagsForResource. **What are the security risks of AWSManagedControlPolicyManagementAccess?** It allows creating, updating, attaching, detaching and deleting policies on all resources in AWS Organizations. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSManagedControlPolicyManagementAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSManagedControlPolicyManagementAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSManagedSettingsReadOnlyAccess - Page: https://iampolicymap.com/policies/awsmanagedsettingsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSManagedSettingsReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 14 control plane, 0 data plane, 3 unclassified. - AWS description: Grants team members read-only access to AWS Settings, including workspace and owner information, team membership, plan and spend summary. It does not grant permissions to modify workspace configuration or to manage billing and payments. - Actions: https://iampolicymap.com/policies/awsmanagedsettingsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Grants team members read-only access to AWS Settings, including workspace and owner information, team membership, plan and spend summary. It does not grant permissions to modify workspace configuration or to manage billing and payments. ### Practical scope Five statements, all on Resource "*". AccountReadOnly allows account:GetAccountInformation and account:GetContactInformation. IdentityStoreReadOnly allows identitystore:DescribeUser, identitystore:ListGroupMemberships, identitystore:ListGroups and identitystore:ListUsers. OrganizationsReadOnly allows organizations:DescribeOrganization, organizations:ListAccounts, organizations:ListDelegatedAdministrators and organizations:ListPolicies. SSOReadOnly allows sso:DescribeInstance. SSODirectoryReadOnly allows sso-directory:DescribeUsers, sso-directory:SearchGroups and sso-directory:SearchUsers. ### Use cases - Let team members view AWS Settings information such as workspace and owner details, team membership and the plan and spend summary, without changing configuration or billing. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it lets a principal read account and contact information, search and describe IAM Identity Center users and groups, and list every account in the organisation. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to AWS Settings information is intended. ### FAQs **When should I attach AWSManagedSettingsReadOnlyAccess?** The reference page says you can attach AWSManagedSettingsReadOnlyAccess to your users, groups and roles, and describes it as read-only access to AWS Settings for team members. Attach it where viewing is the intended scope. **What does AWSManagedSettingsReadOnlyAccess grant?** It allows 14 read actions on all resources: account information and contact information, identity store and IAM Identity Center directory user and group reads, and AWS Organizations account, delegated administrator and policy lists. **What are the security risks of AWSManagedSettingsReadOnlyAccess?** It grants no write actions, but it exposes contact details, directory users and groups, and the list of organisation accounts. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSManagedSettingsReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSManagedSettingsReadOnlyAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSManagementConsoleAdministratorAccess - Page: https://iampolicymap.com/policies/awsmanagementconsoleadministratoraccess/ - ARN: `arn:aws:iam::aws:policy/job-function/AWSManagementConsoleAdministratorAccess` - Kind: job-function. Domain: job-functions. Default version: v7. Guide reviewed against: v7. - Tier: admin. Distinct granted actions: 82 control plane, 2 data plane, 18 unclassified. - AWS description: Provides full access to configure and customize the AWS Management Console - Actions: https://iampolicymap.com/policies/awsmanagementconsoleadministratoraccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: cloudshell (8 of 8). ### Summary Provides full access to configure and customize the AWS Management Console. The AWS Management Console documentation says it lets administrators set account colors, enable user notifications and configure resource discovery, and that it includes the permissions from AWSManagementConsoleBasicUserAccess. ### Practical scope One statement on Resource "*" allows actions from eight prefixes: uxc (get, put and delete account color, get and update account customizations, ListServices), ec2:DescribeRegions, notifications (create, update, delete and get notification configurations and event rules, register and deregister notification hubs, associate and disassociate channels, and enable or disable notifications access for the organization), cloudshell (including CreateSession, file upload and download URLs, PutCredentials and ApproveCommand), q (StartConversation, SendMessage, ListConversations, GetConversation, PassRequest), resource-explorer-2 (create, update and delete indexes and views, search and list actions), action-recommendations:ListRecommendedActions and account:GetAccountInformation. ### Use cases - Let an administrator set account colors and customizations, configure AWS User Notifications, and configure resource discovery in the AWS Management Console. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy includes notifications:EnableNotificationsAccessForOrganization and notifications:DisableNotificationsAccessForOrganization, which change notifications access for the whole organization. - The console documentation says the cloudshell permissions give full access to AWS CloudShell capabilities, including environment creation, session management and command execution. The policy also allows cloudshell:PutCredentials and cloudshell:ApproveCommand. - The resource-explorer-2 actions include creating and deleting indexes and views (resource-explorer-2:CreateIndex, DeleteIndex, CreateView and DeleteView) on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Management Console documentation says you can attach it to your users, groups and roles. It is for the administrators who configure the console, not for every console user; AWSManagementConsoleBasicUserAccess is described as the policy for non-administrative users. ### FAQs **When should I attach AWSManagementConsoleAdministratorAccess?** The AWS Management Console documentation says to use it for administrators who configure and customize the console: set account colors, enable user notifications and configure resource discovery. It says AWSManagementConsoleBasicUserAccess grants the permissions for non-administrative users. **What does AWSManagementConsoleAdministratorAccess grant?** On all resources it allows uxc, notifications, cloudshell, q and resource-explorer-2 actions, plus ec2:DescribeRegions, action-recommendations:ListRecommendedActions and account:GetAccountInformation. It includes managing notification configurations, CloudShell sessions and file transfer, and resource-explorer-2 indexes and views. **What are the security risks of AWSManagementConsoleAdministratorAccess?** It allows enabling and disabling notifications access for the organization, full CloudShell capabilities including command execution, and creating and deleting resource-explorer-2 indexes and views, all on all resources. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSManagementConsoleAdministratorAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSManagementConsoleAdministratorAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Management Console](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSMarketplaceFullAccess - Page: https://iampolicymap.com/policies/awsmarketplacefullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSMarketplaceFullAccess` - Kind: standard. Domain: business-applications. Default version: v8. Guide reviewed against: v8. - Tier: admin. Distinct granted actions: 165 control plane, 0 data plane, 39 unclassified. - AWS description: Provides the ability to subscribe and unsubscribe to AWS Marketplace software, allows users to manage Marketplace software instances from the Marketplace 'Your Software' page, and provides administrative access to EC2. - Actions: https://iampolicymap.com/policies/awsmarketplacefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: aws-marketplace (38 of 38). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides the ability to subscribe and unsubscribe to AWS Marketplace software, allows users to manage Marketplace software instances from the Marketplace 'Your Software' page, and provides administrative access to EC2. The AWS Marketplace Buyer Guide says it grants administrative permissions for full access to AWS Marketplace and related services, including creating and managing a private marketplace and access to Amazon EC2, CloudFormation and Amazon EC2 Systems Manager. ### Practical scope aws-marketplace:* is allowed on Resource "*" along with cloudformation:CreateStack, Describe and List actions, a list of ec2: actions that includes RunInstances, StartInstances, StopInstances, TerminateInstances, CreateSecurityGroup, DeleteSecurityGroup, AuthorizeSecurityGroupIngress and AuthorizeSecurityGroupEgress, license-manager:ListReceivedLicenses and payments:ListPaymentProgramStatus. A second statement allows ec2:CopyImage, DeregisterImage, CreateImage and DeleteSnapshot, SSM document and automation reads, sns:CreateTopic, and iam read actions (GetRole, GetInstanceProfile, ListRoles, ListInstanceProfiles). cloudformation:TagResource and UntagResource require cloudformation:CreateAction equal to CreateStack. signin:CreateOAuth2Token is allowed for the marketplace-mcp.amazonaws.com service principal with the client_credentials grant type. iam:PassRole is allowed on all resources when iam:PassedToService matches ec2.amazonaws.com. ### Use cases - Subscribe and unsubscribe to AWS Marketplace software. - Manage AWS Marketplace software instances from the Marketplace 'Your Software' page. - Create and manage a private marketplace in your account. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Marketplace Buyer Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The Buyer Guide describes the policy as administrative permissions. aws-marketplace:* is allowed on all resources. - The policy allows ec2:RunInstances, ec2:TerminateInstances, ec2:DeregisterImage and ec2:DeleteSnapshot on all resources, and iam:PassRole on all resources when the role is passed to Amazon EC2. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where administrative AWS Marketplace access is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AWSMarketplaceFullAccess?** The AWS Marketplace Buyer Guide says it grants administrative permissions for full access to AWS Marketplace and related services, including subscribing and unsubscribing to software, managing software instances, creating and managing a private marketplace, and access to Amazon EC2, CloudFormation and Systems Manager. Attach it only where that scope is intended. **What does AWSMarketplaceFullAccess grant?** It allows aws-marketplace:* on all resources, CloudFormation stack creation and reads, EC2 actions including launching, starting, stopping and terminating instances and managing security groups and images, SSM, SNS and IAM read and topic-creation actions, license-manager:ListReceivedLicenses, and iam:PassRole to Amazon EC2. **What are the security risks of AWSMarketplaceFullAccess?** aws-marketplace:* is allowed on all resources, and the policy allows launching and terminating EC2 instances, deregistering images and deleting snapshots on all resources, as well as iam:PassRole to Amazon EC2. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. It was last edited on September 11, 2026. ### Sources - [AWSMarketplaceFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Marketplace buyers (AWS Marketplace Buyer Guide)](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSMarketplaceImageBuildFullAccess - Page: https://iampolicymap.com/policies/awsmarketplaceimagebuildfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSMarketplaceImageBuildFullAccess` - Kind: standard. Domain: compute. Default version: v3. Guide reviewed against: v3. - Tier: operator. Distinct granted actions: 23 control plane, 3 data plane, 3 unclassified. - AWS description: Provides full access to AWS Marketplace Private Image Build Feature. In addition to create private images, it also provides permissions to add tags to images, launch and terminate ec2 instances. - Actions: https://iampolicymap.com/policies/awsmarketplaceimagebuildfullaccess/actions.json ### Tier reasons - Grants 11 write, tagging or permissions-management actions, short of full control of any service. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to the AWS Marketplace Private Image Build feature, plus permissions to add tags to images and to launch and terminate EC2 instances. The AWS Marketplace Buyer Guide lists the policy as deprecated. ### Practical scope 10 statements (9 Allow, 1 Deny). Allowed: aws-marketplace:ListBuilds, aws-marketplace:StartBuild and aws-marketplace:DescribeBuilds; ec2:TerminateInstances (conditioned on ec2:ResourceTag/marketplace-image-build:build-id), plus ec2:RunInstances, ec2:CreateImage, ec2:CopyImage, ec2:DeregisterImage and ec2:DeleteSnapshot on "*"; ssm:StartAutomationExecution on automation-definition ARNs in 8 listed Regions; two iam:PassRole statements; s3:GetObject and s3:ListBucket on ARNs matching arn:aws:s3:::*image-build*; sns:Publish on ARNs matching arn:aws:sns:*:*:*image-build*; and ec2:CreateTags. One Deny covers ec2:CreateTags on arn:aws:ec2:*:*:instance/* with StringLike on aws:RequestTag/marketplace-image-build:build-id ("*") and StringNotEquals on ec2:CreateAction (RunInstances). ### Use cases - Historically, run AWS Marketplace Private Image Build to create private images. AWS Marketplace has discontinued that delivery method, so check the Buyer Guide before attaching this policy to new identities. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The AWS Marketplace Buyer Guide lists AWSMarketplaceImageBuildFullAccess as deprecated. Its update table has an entry dated May 30, 2024 saying AWS Marketplace discontinued the Private Image Build delivery method, so the policy was also discontinued. - It allows ec2:RunInstances, ec2:TerminateInstances (with a StringLike condition on ec2:ResourceTag/marketplace-image-build:build-id), ec2:DeregisterImage, ec2:CopyImage, ec2:CreateImage and ec2:DeleteSnapshot, so it can launch instances and delete images and snapshots. - iam:PassRole is allowed on role ARNs matching arn:aws:iam::*:role/*Automation* and arn:aws:iam::*:role/*Instance* with iam:PassedToService ec2.amazonaws.com, and on "*" with iam:PassedToService ssm.amazonaws.com and iam:AssociatedResourceARN matching the listed automation-definition ARNs. The IAM User Guide warns that a passed role can carry more permissions than the person passing it. - s3:GetObject and s3:ListBucket are allowed on ARNs matching arn:aws:s3:::*image-build*, and sns:Publish on ARNs matching arn:aws:sns:*:*:*image-build*. These are patterns, not exact names. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Buyer Guide marks the policy as deprecated, so check whether it is still needed before attaching it. ### FAQs **When should I attach AWSMarketplaceImageBuildFullAccess?** The reference page says you can attach AWSMarketplaceImageBuildFullAccess to your users, groups and roles. However, the AWS Marketplace Buyer Guide lists it as deprecated and says AWS Marketplace discontinued the Private Image Build delivery method, so check whether you still need it before attaching it. **What does AWSMarketplaceImageBuildFullAccess grant?** It allows aws-marketplace build actions, EC2 actions such as ec2:RunInstances, ec2:CreateImage and ec2:TerminateInstances, SSM automation, s3:GetObject and s3:ListBucket on ARNs matching arn:aws:s3:::*image-build*, sns:Publish on ARNs matching arn:aws:sns:*:*:*image-build*, and iam:PassRole in two statements. 10 statements in total. **What are the security risks of AWSMarketplaceImageBuildFullAccess?** It can launch and terminate instances, delete images and snapshots, and pass roles to EC2 and SSM. The Buyer Guide lists it as deprecated. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSMarketplaceImageBuildFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceImageBuildFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Marketplace buyers (AWS Marketplace Buyer Guide)](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSMarketplaceProcurementSystemAdminFullAccess - Page: https://iampolicymap.com/policies/awsmarketplaceprocurementsystemadminfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSMarketplaceProcurementSystemAdminFullAccess` - Kind: standard. Domain: management-governance. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 34 control plane, 0 data plane, 2 unclassified. - AWS description: Provides full access to all administrative actions for an AWS Marketplace eProcurement integration. - Actions: https://iampolicymap.com/policies/awsmarketplaceprocurementsystemadminfullaccess/actions.json ### Tier reasons - Grants 2 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides full access to all administrative actions for an AWS Marketplace eProcurement integration. The AWS Marketplace Buyer Guide says it allows managing all aspects of an eProcurement integration, including listing the accounts in your organization and managing procurement portal preferences. ### Practical scope One statement on Resource "*" allows aws-marketplace:PutProcurementSystemConfiguration, aws-marketplace:DescribeProcurementSystemConfiguration, organizations:Describe*, organizations:List*, invoicing:CreateProcurementPortalPreference, invoicing:GetProcurementPortalPreference and invoicing:ListProcurementPortalPreferences. ### Use cases - Let an administrator set up and manage an AWS Marketplace eProcurement integration, including procurement portal preferences. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - organizations:Describe* and organizations:List* on all resources let principals describe and list accounts and organizational structure in AWS Organizations. - aws-marketplace:PutProcurementSystemConfiguration and invoicing:CreateProcurementPortalPreference change procurement configuration and portal preferences. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Marketplace Buyer Guide says you can attach it to your IAM identities. It fits administrators who manage the eProcurement integration. ### FAQs **When should I attach AWSMarketplaceProcurementSystemAdminFullAccess?** The AWS Marketplace Buyer Guide says you can attach it to your IAM identities. Attach it for administrators who manage all aspects of an AWS Marketplace eProcurement integration. **What does AWSMarketplaceProcurementSystemAdminFullAccess grant?** On all resources it allows aws-marketplace actions to put and describe the procurement system configuration, organizations:Describe* and organizations:List*, and invoicing actions to create, get and list procurement portal preferences. **What are the security risks of AWSMarketplaceProcurementSystemAdminFullAccess?** It can change the procurement system configuration and procurement portal preferences, and it reads accounts and organizational structure in AWS Organizations on all resources. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSMarketplaceProcurementSystemAdminFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceProcurementSystemAdminFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Marketplace buyers](https://docs.aws.amazon.com/marketplace/latest/buyerguide/buyer-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSMarketplaceSellerFullAccess - Page: https://iampolicymap.com/policies/awsmarketplacesellerfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSMarketplaceSellerFullAccess` - Kind: standard. Domain: business-applications. Default version: v35. Guide reviewed against: v35. - Tier: admin. Distinct granted actions: 95 control plane, 1 data plane, 46 unclassified. - AWS description: Provides full access to all seller operations on the AWS Marketplace and other AWS services such as AMI management. - Actions: https://iampolicymap.com/policies/awsmarketplacesellerfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: aws-marketplace-management (5 of 5). - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to all seller operations on the AWS Marketplace and other AWS services such as AMI management. The AWS Marketplace Seller Guide says it grants administrative permissions for all seller operations, including the AWS Marketplace Management Portal and managing the Amazon EC2 AMI used in AMI-based products. ### Practical scope The Seller Guide groups the permissions by service. aws-marketplace actions manage change sets, entities, agreements, payment requests, billing adjustments, invoice submission tasks, verification evidence, tax compliance profiles, resource policies and tags. aws-marketplace-management allows uploading files and viewing reports and support information, plus seller and bank account verification details. ec2 allows describing and modifying AMI images and snapshots. payments and tax allow managing payment instruments and tax registrations. Smaller statements allow vendor-insights reads, support:CreateCase, Amazon Q Partner Assistant conversation actions, partnercentral verification and connection actions, and s3:PutObject to a single ephemeral upload bucket path scoped to the caller's account. iam:GetRole and iam:PassRole apply to arn:aws:iam::*:role/*, with PassRole limited to assets.marketplace.amazonaws.com, and iam:CreateServiceLinkedRole is limited to resale-authorization.marketplace.amazonaws.com. ### Use cases - Give seller administrators access to all seller operations on AWS Marketplace, including the AWS Marketplace Management Portal. - Manage the Amazon EC2 AMI used in AMI-based products. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Marketplace Seller Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The Seller Guide describes the policy as administrative permissions covering all seller operations. It includes payments:CreatePaymentInstrument and payments:DeletePaymentInstrument, tax registration and tax interview updates, and seller and bank account verification updates, all on all resources. - ec2:ModifyImageAttribute and ec2:ModifySnapshotAttribute are allowed on all resources, and aws-marketplace:PutResourcePolicy and aws-marketplace:DeleteResourcePolicy are allowed on AWSMarketplace resources. - iam:PassRole is allowed on arn:aws:iam::*:role/* when the role is passed to assets.marketplace.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. Attach it only to people who administer seller operations; AWSMarketplaceSellerProductsReadOnly is the read-only seller policy the Seller Guide lists for viewing products. ### FAQs **When should I attach AWSMarketplaceSellerFullAccess?** The AWS Marketplace Seller Guide says it grants administrative permissions for full access to all seller operations on AWS Marketplace, including the AWS Marketplace Management Portal and managing the Amazon EC2 AMI used in AMI-based products. You can attach it to users, groups and roles. Attach it only to people who administer seller operations. **What does AWSMarketplaceSellerFullAccess grant?** Seller operations across aws-marketplace and aws-marketplace-management (change sets, entities, agreements, payment requests, billing adjustments, invoices, verification, tax compliance profiles, resource policies, tags, reports and file uploads), EC2 AMI and snapshot describe and modify actions, payments and tax actions, vendor-insights reads, support case creation, Amazon Q Partner Assistant and partnercentral actions, one S3 upload path, and limited IAM role and service-linked role actions. **What are the security risks of AWSMarketplaceSellerFullAccess?** It is an administrative policy. It allows creating and deleting payment instruments, updating tax registrations and seller verification details, and modifying EC2 image and snapshot attributes on all resources. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. It was last edited on November 2, 2026. ### Sources - [AWSMarketplaceSellerFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceSellerFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Marketplace sellers (AWS Marketplace Seller Guide)](https://docs.aws.amazon.com/marketplace/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSMarketplaceSellerProductsReadOnly - Page: https://iampolicymap.com/policies/awsmarketplacesellerproductsreadonly/ - ARN: `arn:aws:iam::aws:policy/AWSMarketplaceSellerProductsReadOnly` - Kind: standard. Domain: business-applications. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 10 control plane, 0 data plane, 0 unclassified. - AWS description: Provide sellers read-only access to AWS Marketplace Management Products page. - Actions: https://iampolicymap.com/policies/awsmarketplacesellerproductsreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides sellers read-only access to the AWS Marketplace Management Products page. The AWS Marketplace Seller Guide says it allows viewing products on the AWS Marketplace Management Portal and viewing the Amazon EC2 AMI used in AMI-based products. ### Practical scope One statement on Resource "*" allows aws-marketplace:ListChangeSets, DescribeChangeSet, ListEntities, DescribeEntity, ListAssessments and DescribeAssessment, plus ec2:DescribeImages and ec2:DescribeSnapshots. aws-marketplace:ListTagsForResource and aws-marketplace:GetResourcePolicy are allowed only on arn:aws:aws-marketplace:*:*:AWSMarketplace/*. ### Use cases - Let sellers view products on the AWS Marketplace Management Portal and the Amazon EC2 AMI used in AMI-based products without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Marketplace Seller Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows only List, Describe and Get actions. The Seller Guide describes it as read-only access. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to seller products is intended. ### FAQs **When should I attach AWSMarketplaceSellerProductsReadOnly?** The AWS Marketplace Seller Guide says it grants read-only permissions to view products on the AWS Marketplace Management Portal and to view the Amazon EC2 AMI used in AMI-based products. Attach it to people who should see products but not change them. **What does AWSMarketplaceSellerProductsReadOnly grant?** It allows aws-marketplace: ListChangeSets, DescribeChangeSet, ListEntities, DescribeEntity, ListAssessments and DescribeAssessment on all resources, ec2:DescribeImages and ec2:DescribeSnapshots, and aws-marketplace:ListTagsForResource and GetResourcePolicy on AWSMarketplace resources. **What are the security risks of AWSMarketplaceSellerProductsReadOnly?** The policy has no write actions. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSMarketplaceSellerProductsReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMarketplaceSellerProductsReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for AWS Marketplace sellers (AWS Marketplace Seller Guide)](https://docs.aws.amazon.com/marketplace/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSMcpServiceActionsFullAccess - Page: https://iampolicymap.com/policies/awsmcpserviceactionsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess` - Kind: standard. Domain: analytics. Default version: v3. Guide reviewed against: v3. - Tier: operator. Distinct granted actions: 22045 control plane, 483 data plane, 4488 unclassified. - AWS description: Provides full access to all MCP service actions. This policy does not grant access to the actions taken by the MCP, only the MCP actions themselves. - Actions: https://iampolicymap.com/policies/awsmcpserviceactionsfullaccess/actions.json ### Tier reasons - Grants 12742 write, tagging or permissions-management actions, short of full control of any service. - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants every action (*), but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - Grants permissions-management actions on iam, but only for scoped resources or under conditions. - Grants permissions-management actions on organizations, but only for scoped resources or under conditions. - Grants permissions-management actions on sso, but only for scoped resources or under conditions. ### Summary Provides full access to all MCP service actions. The reference page says this policy does not grant access to the actions taken by the MCP, only the MCP actions themselves. ### Practical scope One statement, AllowAllMCPServiceActions, allows Action "*" on Resource "*" with the condition Bool aws:IsMcpServiceAction equal to "true". The IAM User Guide says this key is set to True only when the MCP service is authorizing an MCP service action, and that it does not refer to actions taken by the MCP service on other AWS services. ### Use cases - Let a user call any AWS MCP service action when you do not need to specify permissions per AWS MCP service. ### Prerequisites - The IAM User Guide says permissions for actions the MCP service takes on other AWS services must always be granted separately, in addition to MCP service actions. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The statement allows every action on every resource, but only when aws:IsMcpServiceAction is true. The condition limits it to MCP service actions; without that condition key set, the statement does not apply. - The policy does not cover actions the MCP service takes on other AWS services. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide lists it among its policies for users who need access to AWS services through AWS MCP servers. ### FAQs **When should I attach AWSMcpServiceActionsFullAccess?** The IAM User Guide says to use it when a user requires access to AWS services using AWS MCP servers and you do not need to specify permissions per AWS MCP service. The reference page says you can attach it to your users, groups and roles. **What does AWSMcpServiceActionsFullAccess grant?** It allows Action "*" on Resource "*" only when aws:IsMcpServiceAction is true, so it covers MCP service actions. It does not grant permissions for actions the MCP service takes on other AWS services; those must be granted separately. **What are the security risks of AWSMcpServiceActionsFullAccess?** The wildcard action is limited by the aws:IsMcpServiceAction condition, which is set to True only when the MCP service is authorizing an MCP service action. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSMcpServiceActionsFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMcpServiceActionsFullAccess.md), retrieved 2026-11-13 - [AWS global condition context keys (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSOrganizationsFullAccess - Page: https://iampolicymap.com/policies/awsorganizationsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSOrganizationsFullAccess` - Kind: standard. Domain: privileged. Default version: v9. Guide reviewed against: v9. - Tier: admin; High privilege. Distinct granted actions: 74 control plane, 0 data plane, 0 unclassified. - AWS description: Provides full access to AWS Organizations. - Actions: https://iampolicymap.com/policies/awsorganizationsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: organizations (32 of 32). - Grants permissions-management actions on organizations on all resources without conditions. ### Summary Provides full access to AWS Organizations. The AWS Organizations User Guide says it provides all of the permissions required to create and fully administer an organization. ### Practical scope AWSOrganizationsFullAccess allows organizations:* on Resource "*". AWSOrganizationsFullAccessAccount allows account:PutAlternateContact, account:DeleteAlternateContact, account:GetAlternateContact, account:GetContactInformation, account:PutContactInformation, account:ListRegions, account:EnableRegion, account:DisableRegion, account:PutAccountName and account:GetAccountInformation. AWSOrganizationsFullAccessCreateSLR allows iam:CreateServiceLinkedRole when iam:AWSServiceName is organizations.amazonaws.com. ### Use cases - Let an administrator create and fully administer an organization in AWS Organizations, including account contact details, account names and enabling or disabling Regions for accounts. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - organizations:* on Resource "*" allows every AWS Organizations action, which the guide describes as everything needed to create and fully administer an organization. - The policy lets principals change account details: account:PutContactInformation, account:PutAlternateContact, account:DeleteAlternateContact, account:PutAccountName, account:EnableRegion and account:DisableRegion. - The AWS Organizations User Guide says the CreateServiceLinkedRole permission lets the policy create the service-linked role needed to create an organization, and that it is restricted to organizations.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Organizations User Guide says you can attach or detach its managed policies for entities in your organization. It fits the administrators of the organization. ### FAQs **When should I attach AWSOrganizationsFullAccess?** Attach it to the administrators who create and fully administer your organization. The AWS Organizations User Guide says you can attach its managed policies to users or roles in your organization, and the reference page says you can attach it to users, groups and roles. **What does AWSOrganizationsFullAccess grant?** It allows organizations:* on all resources, ten account actions for contacts, account name and Regions, and iam:CreateServiceLinkedRole only for organizations.amazonaws.com. **What are the security risks of AWSOrganizationsFullAccess?** organizations:* gives full administration of the organization, and the account actions change contact details, account names and Regions. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSOrganizationsFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSOrganizationsFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_available-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSOrganizationsReadOnlyAccess - Page: https://iampolicymap.com/policies/awsorganizationsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v6. Guide reviewed against: v6. - Tier: reader. Distinct granted actions: 34 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read-only access to AWS Organizations. - Actions: https://iampolicymap.com/policies/awsorganizationsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to AWS Organizations. The AWS Organizations User Guide says it provides read only access to information about the organization and does not permit the user to make any changes. ### Practical scope AWSOrganizationsReadOnly allows organizations:Describe* and organizations:List* on Resource "*". AWSOrganizationsReadOnlyAccount allows account:GetAlternateContact, account:GetContactInformation, account:ListRegions, account:GetRegionOptStatus and account:GetPrimaryEmail. It has no create, update or delete actions. ### Use cases - Let users view information about the organization, including its accounts, their contact details and enabled Regions, without changing anything. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources. The AWS Organizations User Guide says it lets users view the root user email address and the enabled Regions of any member account in the organization. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Organizations User Guide says you can attach or detach its managed policies for entities in your organization. It fits where read-only visibility of the organization is intended. ### FAQs **When should I attach AWSOrganizationsReadOnlyAccess?** Attach it to users or roles that need to view the organization without making changes. The AWS Organizations User Guide says it provides read only access to information about the organization. **What does AWSOrganizationsReadOnlyAccess grant?** It allows organizations:Describe* and organizations:List*, plus account:GetAlternateContact, account:GetContactInformation, account:ListRegions, account:GetRegionOptStatus and account:GetPrimaryEmail, all on all resources. **What are the security risks of AWSOrganizationsReadOnlyAccess?** The policy grants no write actions, but it exposes organization structure, contact details and root user email addresses of member accounts on all resources. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSOrganizationsReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSOrganizationsReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_reference_available-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSPartnerLedSupportReadOnlyAccess - Page: https://iampolicymap.com/policies/awspartnerledsupportreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSPartnerLedSupportReadOnlyAccess` - Kind: standard. Domain: analytics. Default version: v3. Guide reviewed against: v3. - Tier: operator. Distinct granted actions: 1537 control plane, 12 data plane, 42 unclassified. - AWS description: This policy can be used to grant read-only access to APIs that can read service metadata for services in your AWS account. You can use this policy to provide your partners in the Partner-Led Support Program with access to the services speci… - Actions: https://iampolicymap.com/policies/awspartnerledsupportreadonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Grants read-only access to APIs that can read service metadata for services in your AWS account. The description says you can use it to give partners in the Partner-Led Support Program access to the services listed in its permissions details. ### Practical scope The first statement allows apigateway:GET on a list of Amazon API Gateway resource ARNs such as arn:aws:apigateway:*::/apis. The second statement allows a very long list of actions on Resource "*" for services including ACM, Athena, AWS Backup, CloudFormation, CloudFront, CloudTrail, CloudWatch, Cognito, Direct Connect, AWS DMS, EC2, Amazon ECS, Amazon EKS, IAM, Lambda, Amazon RDS, Amazon Redshift, Route 53, Amazon S3, SageMaker, Amazon SES, Systems Manager, AWS WAF and WorkSpaces. The action names are written in lower camel case, for example acm:describeCertificate. No action name begins with create, put, update, delete, start or run. ### Use cases - Give partners in the Partner-Led Support Program read access to service metadata so they can troubleshoot technical support cases for your account. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy covers many services at once and applies to Resource "*", apart from the API Gateway statement. It includes actions such as iam:getCredentialReport, iam:getAccessKeyLastUsed, cloudtrail:lookupEvents, lambda:getFunction, athena:getQueryExecution and kafka:listScramSecrets. - The AWS Support User Guide says you are responsible for reviewing the services and permissions in the policy to confirm they meet your support requirements, and not to assume it includes all existing or new AWS services. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Support User Guide says you can attach it to your users, groups and roles, and that you can use it to give partners in the AWS Partner-Led Support Program access to the services in its permissions details. Review those services before you attach it. ### FAQs **When should I attach AWSPartnerLedSupportReadOnlyAccess?** The AWS Support User Guide says you can use it to give partners in the AWS Partner-Led Support Program access to the services listed in its permissions details, so they can troubleshoot technical support cases. It also says you are responsible for reviewing those services and permissions against your support requirements. **What does AWSPartnerLedSupportReadOnlyAccess grant?** It allows apigateway:GET on listed API Gateway resources and a very long list of describe, get, list and similar read actions on Resource "*" across the services in the AWS Support User Guide permissions details. No action name begins with create, put, update, delete, start or run. **What are the security risks of AWSPartnerLedSupportReadOnlyAccess?** It reads across many services and includes actions such as iam:getCredentialReport, cloudtrail:lookupEvents and lambda:getFunction on all resources. The AWS Support User Guide says not to assume it includes all existing or new AWS services. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSPartnerLedSupportReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSPartnerLedSupportReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Partner-Led Support](https://docs.aws.amazon.com/awssupport/latest/user/managed-policies-partner-led-support.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSRefactoringToolkitFullAccess - Page: https://iampolicymap.com/policies/awsrefactoringtoolkitfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess` - Kind: standard. Domain: containers. Default version: v8. Guide reviewed against: v8. - Tier: operator. Distinct granted actions: 110 control plane, 4 data plane, 18 unclassified. - AWS description: This policy grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. It is intended to be attached to a local AWS profile. The policy allows uploading application artifacts and d… - Actions: https://iampolicymap.com/policies/awsrefactoringtoolkitfullaccess/actions.json ### Tier reasons - Grants 62 write, tagging or permissions-management actions, short of full control of any service. - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. ### Summary Grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. The description says it is intended to be attached to a local AWS profile. ### Practical scope The policy has many statements. Most write actions are limited by name patterns or tags: CloudFormation actions only on stacks named a2c-app-*, a2c-build-* or application-transformation-app-*; CodeBuild project, EC2, Amazon ECR, Amazon ECS and CloudWatch Logs actions mostly require the a2c-generated or application-transformation tag on the request or the resource; and S3 object actions are on keys matching */refactoringtoolkit*, */a2c-generated* or */application-transformation*, plus s3:GetObject on the aws.portingassistant.dotnet.datastore bucket. ecs:ExecuteCommand is allowed only for containers named a2c-sidecar or application-transformation-sidecar, and KMS actions only for keys with an alias starting alias/application-transformation. Statements with no condition allow codebuild:StartBuild on project/*, and on Resource "*" ec2:CreateSecurityGroup, ecr:GetAuthorizationToken, application-transformation actions (Start and Get operations, PutLogData, PutMetricData), a2c actions, SSM session and ssmmessages channel actions, and 29 describe, list and get actions. ### Use cases - Let a developer use the AWS Toolkit for .NET Refactoring extension in Visual Studio to upload application artifacts to Amazon S3, build container images with AWS CodeBuild, store them in Amazon ECR, and deploy them to Amazon ECS. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy can create VPC resources, key pairs, security groups, ECS clusters and services, CodeBuild projects and CloudFormation stacks, and can run ecs:ExecuteCommand, although most of these are limited by tags or name patterns. ec2:CreateSecurityGroup is allowed on Resource "*" without a condition. - It allows iam:CreateServiceLinkedRole only for arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The description says the policy is intended to be attached to a local AWS profile. Where you attach it to an identity, it fits where use of the AWS Toolkit for .NET Refactoring extension is intended. ### FAQs **When should I attach AWSRefactoringToolkitFullAccess?** The description says it grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio and is intended to be attached to a local AWS profile. The reference page says you can attach it to your users, groups and roles. **What does AWSRefactoringToolkitFullAccess grant?** It allows uploading and downloading application artifacts in Amazon S3, building container images with AWS CodeBuild, storing images in Amazon ECR, and deploying to Amazon ECS, plus optional VPC creation and connection to existing infrastructure such as AWS Directory Service. Most write actions are limited by name patterns or a2c-generated and application-transformation tags. **What are the security risks of AWSRefactoringToolkitFullAccess?** It can create networking, container, build and deployment resources and run commands in containers, and ec2:CreateSecurityGroup is allowed on all resources without a condition. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSRefactoringToolkitFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSRefactoringToolkitFullAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSResourceAccessManagerFullAccess - Page: https://iampolicymap.com/policies/awsresourceaccessmanagerfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSResourceAccessManagerFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 39 control plane, 0 data plane, 3 unclassified. - AWS description: Provides full access to AWS Resource Access Manager - Actions: https://iampolicymap.com/policies/awsresourceaccessmanagerfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: ram (21 of 21). ### Summary Provides full access to AWS Resource Access Manager (AWS RAM). The AWS RAM User Guide says it provides full administrative access to view or modify the resource shares owned by your AWS account. ### Practical scope One statement allows ram:* on Resource "*", with no Condition. The AWS RAM User Guide describes it as granting permission to run any ram operations. ### Use cases - View or modify any information about the resource shares that are owned by your AWS account. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - ram:* allows every AWS RAM action on all resources. The AWS RAM User Guide says the policy lets principals view or modify any information about the resource shares owned by the account. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full AWS RAM access is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AWSResourceAccessManagerFullAccess?** The AWS RAM User Guide says you can attach it to your IAM identities and that it provides full administrative access to view or modify the resource shares owned by your AWS account. Attach it where that scope is intended. If someone needs less, AWS recommends customer managed policies specific to your use cases. **What does AWSResourceAccessManagerFullAccess grant?** It allows ram:* on all resources, which the AWS RAM User Guide describes as permission to run any ram operations on the resource shares owned by the account. **What are the security risks of AWSResourceAccessManagerFullAccess?** ram:* allows every AWS RAM action on all resources and the policy has no condition. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSResourceAccessManagerFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceAccessManagerFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Resource Access Manager (AWS RAM User Guide)](https://docs.aws.amazon.com/ram/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSResourceAccessManagerReadOnlyAccess - Page: https://iampolicymap.com/policies/awsresourceaccessmanagerreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSResourceAccessManagerReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 16 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read only access to AWS Resource Access Manager. - Actions: https://iampolicymap.com/policies/awsresourceaccessmanagerreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to AWS Resource Access Manager (AWS RAM). The AWS RAM User Guide says it provides read-only permissions to the resource shares owned by your AWS account. ### Practical scope One statement allows ram:Get* and ram:List* on Resource "*", with no Condition. The AWS RAM User Guide says it grants permission to run any of the Get* or List* operations and does not provide any ability to modify any resource share. ### Use cases - View details about the resource shares that are owned by your AWS account. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - ram:Get* and ram:List* apply to all resources, so principals can view details of every resource share the account owns. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where viewing AWS RAM resource shares is the only requirement. ### FAQs **When should I attach AWSResourceAccessManagerReadOnlyAccess?** The AWS RAM User Guide says you can attach it to your IAM identities to give read-only permissions to the resource shares owned by your account. Use it for people who only need to view resource shares. **What does AWSResourceAccessManagerReadOnlyAccess grant?** It allows ram:Get* and ram:List* on all resources. The AWS RAM User Guide says it does not provide any ability to modify any resource share. **What are the security risks of AWSResourceAccessManagerReadOnlyAccess?** The grant is limited to ram:Get* and ram:List* but covers all resources, so everything about the account's resource shares is visible to the holder. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSResourceAccessManagerReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceAccessManagerReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Resource Access Manager (AWS RAM User Guide)](https://docs.aws.amazon.com/ram/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSResourceGroupsReadOnlyAccess - Page: https://iampolicymap.com/policies/awsresourcegroupsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v2. Guide reviewed against: v2. - Tier: reader. Distinct granted actions: 57 control plane, 0 data plane, 4 unclassified. - AWS description: This is the read only policy for AWS Resource Groups - Actions: https://iampolicymap.com/policies/awsresourcegroupsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary The read only policy for AWS Resource Groups, as the AWS Managed Policy Reference Guide describes it. ### Practical scope One statement allows, on Resource "*" with no Condition, resource-groups:Get*, resource-groups:List* and resource-groups:Search*, tag:Get*, and describe and list actions for other services: CloudFormation, Amazon EC2, ElastiCache, Elastic Beanstalk, Amazon EMR, S3 Glacier, Kinesis, OpsWorks, Amazon RDS, Amazon Redshift, Route 53, Route 53 Domains, Storage Gateway, Amazon S3 (s3:ListAllMyBuckets and s3:GetBucketTagging), Elastic Load Balancing and Systems Manager (ssm:ListDocuments). ### Use cases - View AWS Resource Groups and the tags and resources of the services listed above. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The grant spans many services but is limited to Get, List, Describe and Search style actions, all on Resource "*". - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where viewing resource groups and the related resources is the only requirement. ### FAQs **When should I attach AWSResourceGroupsReadOnlyAccess?** The reference page describes it as the read only policy for AWS Resource Groups, and says you can attach it to users, groups and roles. Attach it for people who need to view resource groups. **What does AWSResourceGroupsReadOnlyAccess grant?** It allows resource-groups:Get*, List* and Search*, tag:Get*, and a set of describe and list actions across CloudFormation, EC2, ElastiCache, Elastic Beanstalk, EMR, S3 Glacier, Kinesis, OpsWorks, RDS, Redshift, Route 53, Storage Gateway, S3, Elastic Load Balancing and Systems Manager, all on all resources. **What are the security risks of AWSResourceGroupsReadOnlyAccess?** The permissions are reads, but they cover many services on all resources, so a holder can see resource inventory and tags broadly. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSResourceGroupsReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSResourceGroupsReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSSSODirectoryReadOnly - Page: https://iampolicymap.com/policies/awsssodirectoryreadonly/ - ARN: `arn:aws:iam::aws:policy/AWSSSODirectoryReadOnly` - Kind: standard. Domain: security-identity-compliance. Default version: v7. Guide reviewed against: v7. - Tier: operator. Distinct granted actions: 37 control plane, 0 data plane, 27 unclassified. - AWS description: ReadOnly access for SSO Directory - Actions: https://iampolicymap.com/policies/awsssodirectoryreadonly/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary ReadOnly access for SSO Directory. The IAM Identity Center User Guide says it grants read-only permissions that allow users to view users and groups in IAM Identity Center. ### Practical scope Two statements. AWSSSODirectoryReadOnly allows sso-directory:Search*, sso-directory:Describe*, sso-directory:List*, sso-directory:Get*, identitystore:Describe*, identitystore:List*, identitystore-auth:ListSessions and identitystore-auth:BatchGetSession on Resource "*". AllowKMSKeyUseViaAWSIdentityStoreService allows kms:Decrypt on all keys only when called via identitystore.*.amazonaws.com and the encryption context names an identity store. ### Use cases - Let users view the users and groups in IAM Identity Center, including instances that use customer managed keys for encryption. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The IAM Identity Center User Guide says principals with this policy cannot view IAM Identity Center assignments, permission sets, applications or settings, and cannot make updates. - It still lets a principal read every user and group in the directory, and it includes identitystore-auth:ListSessions and identitystore-auth:BatchGetSession. kms:Decrypt is limited by conditions to calls via the identity store. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM Identity Center User Guide says you can attach it to your IAM identities. It fits where read-only access to Identity Center users and groups is intended. ### FAQs **When should I attach AWSSSODirectoryReadOnly?** The IAM Identity Center User Guide says you can attach AWSSSODirectoryReadOnly to your IAM identities, and that it grants read-only permissions to view users and groups in IAM Identity Center. Attach it where viewing the directory is the intended scope. **What does AWSSSODirectoryReadOnly grant?** It allows sso-directory Search*, Describe*, List* and Get* actions, identitystore Describe* and List* actions, identitystore-auth:ListSessions and identitystore-auth:BatchGetSession on all resources, and kms:Decrypt under an identity store via-service condition. **What are the security risks of AWSSSODirectoryReadOnly?** The IAM Identity Center User Guide says principals with this policy cannot make updates in IAM Identity Center. The site classifies the policy as Operator tier because kms:Decrypt is classified as a Write action. The policy also reads every directory user and group, includes the sso-directory List and Get actions and session list actions, and its kms:Decrypt is limited by conditions to calls via the identity store. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSSODirectoryReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSODirectoryReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for AWS IAM Identity Center (IAM Identity Center User Guide)](https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSSSOMasterAccountAdministrator - Page: https://iampolicymap.com/policies/awsssomasteraccountadministrator/ - ARN: `arn:aws:iam::aws:policy/AWSSSOMasterAccountAdministrator` - Kind: standard. Domain: privileged. Default version: v13. Guide reviewed against: v13. - Tier: admin; High privilege. Distinct granted actions: 244 control plane, 0 data plane, 91 unclassified. - AWS description: Provides access within AWS SSO to manage AWS Organizations master and member accounts and cloud application - Actions: https://iampolicymap.com/policies/awsssomasteraccountadministrator/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: identitystore (14 of 14), sso (66 of 66), sso-directory (32 of 32). - Grants permissions-management actions on sso on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides access within AWS SSO to manage AWS Organizations master and member accounts and cloud application, according to the reference page description. The IAM Identity Center User Guide says it provides the administrative actions for principals who perform the job role of an IAM Identity Center administrator, and that the list of actions is updated over time to match IAM Identity Center functionality. ### Practical scope Statements allow iam:CreateServiceLinkedRole and iam:PassRole only on the arn:aws:iam::*:role/aws-service-role/sso.amazonaws.com/AWSServiceRoleForSSO role, with conditions that restrict them to sso.amazonaws.com. A large statement on Resource "*" allows sso:*, sso-directory:*, identitystore:* and identitystore-auth:*, five ds: actions (DescribeTrusts, UnauthorizeApplication, DescribeDirectories, AuthorizeApplication, CreateAlias), organizations: enable, list and describe actions, iam:ListPolicies, access-analyzer:ValidatePolicy and two signin: trusted identity propagation actions. organizations:RegisterDelegatedAdministrator and organizations:DeregisterDelegatedAdministrator are allowed only when organizations:ServicePrincipal equals sso.amazonaws.com. identity-sync:DeleteSyncProfile is allowed on identity-sync profile ARNs. kms:Encrypt, kms:Decrypt and kms:GenerateDataKeyWithoutPlaintext are allowed only when called through IAM Identity Center or the identity store, and kms:ListAliases and kms:DescribeKey are allowed on all resources. ### Use cases - Give an IAM Identity Center administrator the administrative permissions the User Guide describes: managing IAM Identity Center operations in the AWS Organizations management account and all member accounts. - Support enabling IAM Identity Center. The User Guide says the iam:PassRole statement is necessary when a person or application attempts to enable IAM Identity Center. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The IAM Identity Center User Guide says a principal with this policy can fully manage all IAM Identity Center operations, including creating an IAM Identity Center instance, users, permission sets and assignments, and can instantiate those assignments across the AWS Organizations member accounts. - The User Guide also says that as new administrative features are released, the account administrator is granted the new permissions automatically. - sso:*, sso-directory:*, identitystore:* and identitystore-auth:* are allowed on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM Identity Center User Guide intends it for principals who perform the job role of an IAM Identity Center administrator, and says principals with it can access IAM Identity Center within the AWS Organizations management account and all member accounts. ### FAQs **When should I attach AWSSSOMasterAccountAdministrator?** The IAM Identity Center User Guide says it is intended for principals who perform the job role of an IAM Identity Center administrator. You can attach it to users, groups and roles. Because it grants administrative IAM Identity Center permissions across the AWS Organizations management account and member accounts, attach it only where that scope is intended. The IAM User Guide says AWS managed policies don't grant least privilege permissions. **What does AWSSSOMasterAccountAdministrator grant?** It allows sso:*, sso-directory:*, identitystore:* and identitystore-auth:* on all resources, plus directory (ds:), AWS Organizations, IAM policy-listing and Access Analyzer validation actions that support administration. It allows creating and passing the IAM Identity Center service-linked role, registering and deregistering a delegated administrator (limited to the sso.amazonaws.com service principal), deleting identity-sync profiles, and the AWS KMS actions that IAM Identity Center instances with customer managed keys need. **What are the security risks of AWSSSOMasterAccountAdministrator?** The IAM Identity Center User Guide says a principal with the policy can fully manage all IAM Identity Center operations, including creating permission sets and assignments across member accounts, and that new administrative permissions are granted automatically as features are released. AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSSOMasterAccountAdministrator (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSOMasterAccountAdministrator.md), retrieved 2026-11-13 - [AWS managed policies for AWS IAM Identity Center (IAM Identity Center User Guide)](https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSSSOMemberAccountAdministrator - Page: https://iampolicymap.com/policies/awsssomemberaccountadministrator/ - ARN: `arn:aws:iam::aws:policy/AWSSSOMemberAccountAdministrator` - Kind: standard. Domain: privileged. Default version: v11. Guide reviewed against: v11. - Tier: admin; High privilege. Distinct granted actions: 241 control plane, 0 data plane, 90 unclassified. - AWS description: Provides access within AWS SSO to manage AWS Organizations member accounts and cloud application - Actions: https://iampolicymap.com/policies/awsssomemberaccountadministrator/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: identitystore (14 of 14), sso (66 of 66), sso-directory (32 of 32). - Grants permissions-management actions on sso on all resources without conditions. ### Summary Provides access within AWS SSO to manage AWS Organizations member accounts and cloud application, according to the reference page description. The IAM Identity Center User Guide says it provides the administrative actions for principals who perform the job role of an IAM Identity Center administrator, and that the list of actions is updated over time to match IAM Identity Center functionality. ### Practical scope One statement on Resource "*" allows sso:*, sso-directory:*, identitystore:* and identitystore-auth:*, five ds: actions (DescribeDirectories, AuthorizeApplication, UnauthorizeApplication, DescribeTrusts, CreateAlias), organizations: enable, list and describe actions, iam:ListPolicies, access-analyzer:ValidatePolicy and two signin: trusted identity propagation actions. organizations:RegisterDelegatedAdministrator and organizations:DeregisterDelegatedAdministrator are allowed only when organizations:ServicePrincipal equals sso.amazonaws.com. kms:Encrypt, kms:Decrypt and kms:GenerateDataKeyWithoutPlaintext are allowed only when called through IAM Identity Center or the identity store, and kms:ListAliases and kms:DescribeKey are allowed on all resources. Unlike AWSSSOMasterAccountAdministrator, it has no iam:CreateServiceLinkedRole, iam:PassRole or identity-sync statement. ### Use cases - Give an IAM Identity Center administrator the administrative permissions the User Guide describes: managing users, permission sets and assignments across the AWS Organizations management account and member accounts. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The IAM Identity Center User Guide says a principal with this policy can fully manage all IAM Identity Center operations, including creating users, permission sets and assignments, and can instantiate those assignments across the AWS Organizations member accounts. - The User Guide also says that as new administrative features are released, the account administrator is granted the new permissions automatically. - sso:*, sso-directory:*, identitystore:* and identitystore-auth:* are allowed on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM Identity Center User Guide intends it for principals who perform the job role of an IAM Identity Center administrator, and says principals with it can access IAM Identity Center within the AWS Organizations management account and all member accounts. ### FAQs **When should I attach AWSSSOMemberAccountAdministrator?** The IAM Identity Center User Guide says it is intended for principals who perform the job role of an IAM Identity Center administrator. You can attach it to users, groups and roles. It grants administrative IAM Identity Center permissions across the AWS Organizations management account and member accounts, so attach it only where that scope is intended. **What does AWSSSOMemberAccountAdministrator grant?** It allows sso:*, sso-directory:*, identitystore:* and identitystore-auth:* on all resources, plus directory (ds:), AWS Organizations, IAM policy-listing and Access Analyzer validation actions that support administration. It allows registering and deregistering a delegated administrator (limited to the sso.amazonaws.com service principal) and the AWS KMS actions that IAM Identity Center instances with customer managed keys need. **What are the security risks of AWSSSOMemberAccountAdministrator?** The IAM Identity Center User Guide says a principal with the policy can fully manage all IAM Identity Center operations, including creating permission sets and assignments across member accounts, and that new administrative permissions are granted automatically as features are released. AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSSOMemberAccountAdministrator (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSOMemberAccountAdministrator.md), retrieved 2026-11-13 - [AWS managed policies for AWS IAM Identity Center (IAM Identity Center User Guide)](https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSSSOReadOnly - Page: https://iampolicymap.com/policies/awsssoreadonly/ - ARN: `arn:aws:iam::aws:policy/AWSSSOReadOnly` - Kind: standard. Domain: security-identity-compliance. Default version: v12. Guide reviewed against: v12. - Tier: operator. Distinct granted actions: 76 control plane, 0 data plane, 9 unclassified. - AWS description: Provides read only access to AWS SSO configurations. - Actions: https://iampolicymap.com/policies/awsssoreadonly/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Provides read only access to AWS SSO configurations. The IAM Identity Center User Guide says principals with this policy can view information in IAM Identity Center but cannot view IAM Identity Center users or groups directly and cannot make any updates, and that it includes AWS KMS permissions for instances that use customer managed keys. ### Practical scope 3 statements, all Allow. AWSSSOReadOnly allows 19 entries on Resource "*": ds:DescribeDirectories, ds:DescribeTrusts, iam:ListPolicies, 9 AWS Organizations read entries (such as organizations:ListAccounts and organizations:ListDelegatedAdministrators), sso:Describe*, sso:Get*, sso:List*, sso:Search*, sso-directory:DescribeDirectory, access-analyzer:ValidatePolicy and signin:ListTrustedIdentityPropagationApplicationsForConsole. AllowKMSKeyUseViaAWSIAMIdentityCenterService allows kms:Decrypt with StringLike conditions on kms:ViaService (sso.*.amazonaws.com) and kms:EncryptionContext:aws:sso:instance-arn ("*"). AllowKMSKeyDiscovery allows kms:ListAliases and kms:DescribeKey on "*". ### Use cases - Give users or roles read-only access to view IAM Identity Center configuration. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It is not limited to IAM Identity Center. It also includes ds:DescribeDirectories and ds:DescribeTrusts, AWS Organizations read entries, iam:ListPolicies and access-analyzer:ValidatePolicy, all on all resources. - It includes kms:Decrypt (conditioned on kms:ViaService and the IAM Identity Center instance ARN encryption context), kms:ListAliases and kms:DescribeKey, so it is more than metadata reads for instances that use customer managed keys. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM Identity Center User Guide says you can attach it to your IAM identities. It fits where view-only access to IAM Identity Center configuration is intended. ### FAQs **When should I attach AWSSSOReadOnly?** The reference page says you can attach AWSSSOReadOnly to your users, groups and roles, and describes it as: provides read only access to AWS SSO configurations. Attach it where viewing IAM Identity Center configuration is the intended scope. **What does AWSSSOReadOnly grant?** It allows ds, iam, organizations, sso, sso-directory, access-analyzer and signin read entries on all resources (including sso:Describe*, sso:Get*, sso:List* and sso:Search*), kms:Decrypt under IAM Identity Center conditions, and kms:ListAliases and kms:DescribeKey. **What are the security risks of AWSSSOReadOnly?** It makes no IAM Identity Center updates, but it reaches into ds, organizations and iam read entries, and it includes kms:Decrypt under conditions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSSOReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSSOReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for AWS IAM Identity Center (IAM Identity Center User Guide)](https://docs.aws.amazon.com/singlesignon/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSSecretsManagerClientReadOnlyAccess - Page: https://iampolicymap.com/policies/awssecretsmanagerclientreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSSecretsManagerClientReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v4. Guide reviewed against: v4. - Tier: operator. Distinct granted actions: 5 control plane, 0 data plane, 0 unclassified. - AWS description: Provides access to retrieve and describe secrets from Secrets Manager. This policy also allows decrypting KMS keys for Secrets Manager secrets. - Actions: https://iampolicymap.com/policies/awssecretsmanagerclientreadonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Provides access to retrieve and describe secrets from Secrets Manager, and allows decrypting KMS keys for Secrets Manager secrets. The AWS Secrets Manager guide describes it as read-only access to secrets for client applications: retrieving secret values individually or in batches, listing secrets and describing secret metadata. ### Practical scope Three statements. SecretsManagerGetAndDescribeSecret allows secretsmanager:GetSecretValue and secretsmanager:DescribeSecret on ARNs matching arn:aws:secretsmanager:*:*:secret:*. SecretsManagerBatchGetSecrets allows secretsmanager:BatchGetSecretValue and secretsmanager:ListSecrets on Resource "*". KMSDecryptKey allows kms:Decrypt on ARNs matching arn:aws:kms:*:*:key/*, with a StringLike condition on kms:EncryptionContext:SecretARN (arn:aws:secretsmanager:*:*:secret:*) and on kms:ViaService (secretsmanager.*.amazonaws.com). ### Use cases - Give client applications, and the users or roles they run as, read access to retrieve secret values, list secrets and describe secret metadata in AWS Secrets Manager. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - Despite the ReadOnly name it allows secretsmanager:GetSecretValue and secretsmanager:BatchGetSecretValue, so a principal can read secret values, not only metadata. The secret ARN pattern uses wildcards for the Region and account segments. - It also allows kms:Decrypt on key ARNs matching arn:aws:kms:*:*:key/*. The conditions on kms:ViaService and kms:EncryptionContext:SecretARN tie the call to Secrets Manager. - The Secrets Manager guide's update table says the policy was updated on June 02, 2026 (v4) to add BatchGetSecretValue and ListSecrets so client applications can retrieve multiple secrets in a single call. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Secrets Manager guide describes it as read-only access to secrets for client applications. ### FAQs **When should I attach AWSSecretsManagerClientReadOnlyAccess?** The reference page says you can attach AWSSecretsManagerClientReadOnlyAccess to your users, groups and roles, and describes it as: provides access to retrieve and describe secrets from Secrets Manager. Attach it where reading secret values from Secrets Manager is the intended scope. **What does AWSSecretsManagerClientReadOnlyAccess grant?** It allows secretsmanager:GetSecretValue and secretsmanager:DescribeSecret on ARNs matching arn:aws:secretsmanager:*:*:secret:*, secretsmanager:BatchGetSecretValue and secretsmanager:ListSecrets on all resources, and kms:Decrypt on key ARNs matching arn:aws:kms:*:*:key/* under conditions on kms:ViaService and kms:EncryptionContext:SecretARN. **What are the security risks of AWSSecretsManagerClientReadOnlyAccess?** It is read only by name, but it can return secret values (GetSecretValue and BatchGetSecretValue) and decrypt with KMS keys under the stated conditions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSecretsManagerClientReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSecretsManagerClientReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policy for AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/latest/userguide/reference_available-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSServiceCatalogAdminReadOnlyAccess - Page: https://iampolicymap.com/policies/awsservicecatalogadminreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 75 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read-only access to Service Catalog admin capabilities - Actions: https://iampolicymap.com/policies/awsservicecatalogadminreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Service Catalog admin capabilities. The AWS Service Catalog AppRegistry page of the Administrator Guide says it grants read-only permissions with full access to the administrator console view, and does not grant access to create or manage products and portfolios. ### Practical scope CloudFormation describe and list actions (stacks, change sets, stack sets, stack instances and stack set operations) are allowed only on stacks, change sets and stack sets named SC-* or StackSet-SC-*. On Resource "*" the policy allows cloudformation:GetTemplateSummary, iam:GetGroup, GetRole, GetUser, ListGroups, ListRoles and ListUsers, servicecatalog:Get*, List*, Describe*, ScanProvisionedProducts and Search*, ssm:DescribeDocument, GetAutomationExecution, ListDocuments and ListDocumentVersions, and config:DescribeConfigurationRecorders and DescribeConfigurationRecorderStatus. ### Use cases - Give administrators read-only access to the Service Catalog administrator console view, including portfolios, products and provisioned products, without the ability to create or manage them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows only read-style actions. The Administrator Guide says it does not grant access to create or manage products and portfolios. - iam:ListUsers, iam:ListGroups and iam:ListRoles are allowed on all resources. The Administrator Guide says the iam permissions let principals view the users, groups and roles needed for creating and managing products and portfolios. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM entities. The Administrator Guide also says AppRegistry attaches this policy to a service role that allows AppRegistry to perform actions on your behalf. The reference page says users, groups and roles, and links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. ### FAQs **When should I attach AWSServiceCatalogAdminReadOnlyAccess?** The Administrator Guide says it grants read-only permissions to the administrator console view and does not allow creating or managing products and portfolios. Attach it to people who need to view Service Catalog administration but not change it. AppRegistry also attaches it to its own service role. **What does AWSServiceCatalogAdminReadOnlyAccess grant?** It allows servicecatalog Get, List, Describe, Search and ScanProvisionedProducts actions, CloudFormation describe and list actions on SC-* stacks, change sets and stack sets, iam get and list actions for users, groups and roles, Systems Manager document reads, and AWS Config configuration recorder describe actions. **What are the security risks of AWSServiceCatalogAdminReadOnlyAccess?** The policy allows only read-style actions, but they apply to all resources for servicecatalog, iam, ssm and config. The IAM User Guide says AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSServiceCatalogAdminReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceCatalogAdminReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Service Catalog AppRegistry (AWS Service Catalog Administrator Guide)](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSServiceCatalogAppRegistryFullAccess - Page: https://iampolicymap.com/policies/awsservicecatalogappregistryfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSServiceCatalogAppRegistryFullAccess` - Kind: standard. Domain: management-governance. Default version: v7. Guide reviewed against: v7. - Tier: operator. Distinct granted actions: 39 control plane, 0 data plane, 2 unclassified. - AWS description: Provides full access to Service Catalog App Registry capabilities - Actions: https://iampolicymap.com/policies/awsservicecatalogappregistryfullaccess/actions.json ### Tier reasons - Grants 24 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides full access to Service Catalog App Registry capabilities, as the AWS Managed Policy Reference Guide describes it. ### Practical scope Statements allow, on Resource "*", 21 servicecatalog actions for applications and attribute groups (for example servicecatalog:CreateApplication, DeleteApplication, CreateAttributeGroup, AssociateResource and PutConfiguration) plus cloudformation:DescribeStacks. servicecatalog:TagResource, UntagResource and ListTagsForResource apply to servicecatalog resources. cloudformation:UpdateStack, tag:GetResources, cloudformation:TagResource and cloudformation:UntagResource are allowed only when the call is made through servicecatalog-appregistry.amazonaws.com (the aws:CalledVia condition), and TagResource and UntagResource also require cloudformation:CreateAction to be UpdateStack. Nine resource-groups actions, including CreateGroup and DeleteGroup, apply to groups named AWS_* under the same CalledVia condition. iam:CreateServiceLinkedRole is allowed only for the AWSServiceRoleForAWSServiceCatalogAppRegistry role when the service name is servicecatalog-appregistry.amazonaws.com. ### Use cases - Create, update, delete and associate Service Catalog AppRegistry applications and attribute groups. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The servicecatalog application and attribute group actions, including delete actions, apply to all resources. - The CloudFormation and Resource Groups actions are limited by the aws:CalledVia condition, so they apply only to calls made through AppRegistry. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full AppRegistry access is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AWSServiceCatalogAppRegistryFullAccess?** The reference page describes it as full access to Service Catalog App Registry capabilities, and says you can attach it to users, groups and roles. Attach it where that scope is intended. **What does AWSServiceCatalogAppRegistryFullAccess grant?** It allows servicecatalog actions for applications and attribute groups on all resources, tagging of servicecatalog resources, and, only when called through AppRegistry, CloudFormation update and tagging actions and Resource Groups actions on AWS_* groups. It also allows creating the AppRegistry service-linked role. **What are the security risks of AWSServiceCatalogAppRegistryFullAccess?** Application and attribute group changes, including deletes, apply to all resources. The CloudFormation and Resource Groups grants are limited to calls made through AppRegistry. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AWSServiceCatalogAppRegistryFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSServiceCatalogAppRegistryFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSSupportAccess - Page: https://iampolicymap.com/policies/awssupportaccess/ - ARN: `arn:aws:iam::aws:policy/AWSSupportAccess` - Kind: standard. Domain: management-governance. Default version: v4. Guide reviewed against: v4. - Tier: admin. Distinct granted actions: 52 control plane, 0 data plane, 34 unclassified. - AWS description: Allows users to access the AWS Support Center. - Actions: https://iampolicymap.com/policies/awssupportaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: support (17 of 17). ### Summary Allows users to access the AWS Support Center. AWS Support uses it to manage your support case lifecycle through the Support API, and enhanced functionality in the AWS Support Center Console is provided through the support-console API service. ### Practical scope The policy is a single statement that allows support:* and support-console:* on Resource "*". ### Use cases - The Support user job function in the IAM User Guide: a user who contacts AWS Support, creates support cases and views the status of existing cases. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It allows every action in the support and support-console namespaces on all resources, not only creating cases. - AWS updated it to add permissions for the support-console API on July 18, 2025, and updates to an AWS managed policy affect every identity it is attached to. You cannot change the permissions in an AWS managed policy. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The AWS Support User Guide says you can attach this policy to your IAM entities, and the IAM User Guide lists it as the policy for the Support user job function. ### FAQs **When should I attach AWSSupportAccess?** Attach it to a user who contacts AWS Support, creates support cases and views the status of existing cases. **What does AWSSupportAccess grant?** It allows support:* and support-console:* on all resources. AWS Support uses it to manage your support case lifecycle through the Support API, with enhanced Support Center Console functionality provided through the support-console API service. **What are the security risks of AWSSupportAccess?** It grants every action in the support and support-console namespaces on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSSupportAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSSupportAccess.md), retrieved 2026-11-12 - [AWS managed policies for AWS Support (AWS Support User Guide)](https://docs.aws.amazon.com/awssupport/latest/user/aws-managed-policies-aws-support.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AWSXrayFullAccess - Page: https://iampolicymap.com/policies/awsxrayfullaccess/ - ARN: `arn:aws:iam::aws:policy/AWSXrayFullAccess` - Kind: standard. Domain: monitoring-observability. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 32 control plane, 12 data plane, 6 unclassified. - AWS description: AWS X-Ray full access managed policy - Actions: https://iampolicymap.com/policies/awsxrayfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: xray (17 of 17). ### Summary AWS X-Ray full access managed policy. The X-Ray Developer Guide says it grants permission to use all X-Ray APIs, including read permissions, write permissions, and permission to configure encryption key settings and sampling rules. ### Practical scope One statement (AWSXrayFullAccess) allows xray:* on Resource "*". ### Use cases - Give users or roles full access to AWS X-Ray, including read and write permissions and configuring encryption key settings and sampling rules. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - xray:* on Resource "*" allows every X-Ray action, including write actions and changes to encryption key settings and sampling rules, not only reads. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where use of all X-Ray APIs is intended. ### FAQs **When should I attach AWSXrayFullAccess?** The reference page says you can attach AWSXrayFullAccess to your users, groups and roles, and describes it as: AWS X-Ray full access managed policy. Attach it where full use of AWS X-Ray is the intended scope. **What does AWSXrayFullAccess grant?** It allows xray:* on all resources. The X-Ray Developer Guide describes this as permission to use all X-Ray APIs, including read permissions, write permissions, and permission to configure encryption key settings and sampling rules. **What are the security risks of AWSXrayFullAccess?** xray:* allows every X-Ray action, including write actions and encryption and sampling configuration. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSXrayFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSXrayFullAccess.md), retrieved 2026-11-13 - [AWS X-Ray identity-based policy examples](https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AWSXrayReadOnlyAccess - Page: https://iampolicymap.com/policies/awsxrayreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AWSXrayReadOnlyAccess` - Kind: standard. Domain: monitoring-observability. Default version: v8. Guide reviewed against: v8. - Tier: reader. Distinct granted actions: 12 control plane, 6 data plane, 2 unclassified. - AWS description: AWS X-Ray read only managed policy - Actions: https://iampolicymap.com/policies/awsxrayreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary AWS X-Ray read only managed policy. The X-Ray Developer Guide says it provides read permissions for using the X-Ray console, AWS CLI or AWS SDK to get trace data, trace maps, insights and X-Ray configuration from the X-Ray API. ### Practical scope One statement (AWSXrayReadOnlyAccess) allows 18 xray actions on Resource "*": GetSamplingRules, GetSamplingTargets, GetSamplingStatisticSummaries, BatchGetTraces, BatchGetTraceSummaryById, GetDistinctTraceGraphs, GetServiceGraph, GetTraceGraph, GetTraceSummaries, GetGroups, GetGroup, ListTagsForResource, ListResourcePolicies, GetTimeSeriesServiceStatistics, GetInsightSummaries, GetInsight, GetInsightEvents and GetInsightImpactGraph. ### Use cases - Give users or roles read access to X-Ray traces, service maps, insights and configuration. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It has no write actions in the document, but it applies to all resources, and it includes BatchGetTraces and GetTraceSummaries, which the X-Ray guide ties to getting trace data. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to X-Ray is intended. ### FAQs **When should I attach AWSXrayReadOnlyAccess?** The reference page says you can attach AWSXrayReadOnlyAccess to your users, groups and roles, and describes it as: AWS X-Ray read only managed policy. Attach it where viewing X-Ray traces and insights is the intended scope. **What does AWSXrayReadOnlyAccess grant?** It allows 18 xray read actions on all resources, covering traces, trace summaries, service and trace graphs, insights, groups, sampling rules and targets, tags and resource policies. **What are the security risks of AWSXrayReadOnlyAccess?** It grants no write actions, but it applies to all resources and includes xray:BatchGetTraces and xray:GetTraceSummaries, which return trace data. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AWSXrayReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSXrayReadOnlyAccess.md), retrieved 2026-11-13 - [AWS X-Ray identity-based policy examples](https://docs.aws.amazon.com/xray/latest/devguide/security_iam_id-based-policy-examples.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AdministratorAccess - Page: https://iampolicymap.com/policies/administratoraccess/ - ARN: `arn:aws:iam::aws:policy/AdministratorAccess` - Kind: standard. Domain: privileged. Default version: v1. Guide reviewed against: v1. - Tier: admin; High privilege. Distinct granted actions: 22045 control plane, 483 data plane, 4488 unclassified. - AWS description: Provides full access to AWS services and resources. - Actions: https://iampolicymap.com/policies/administratoraccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: a4b (61 of 61), access-analyzer (15 of 15), account (12 of 12), acm (20 of 20), acm-pca (12 of 12), aco-automation (8 of 8), agent-registry (10 of 10), agentaccess-mcp (21 of 21), aidevops (45 of 45), and 357 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants every action (*) on all resources. - Grants iam:PassRole on all resources without conditions. - Grants permissions-management actions on iam on all resources without conditions. - Grants permissions-management actions on organizations on all resources without conditions. - Grants permissions-management actions on sso on all resources without conditions. - 215 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary Provides full access to AWS services and resources. The policy has one Allow statement with Action "*" and Resource "*". ### Practical scope Because both Action and Resource are "*", the policy allows every action on every resource, across every AWS service. The IAM User Guide lists it as the Administrator job function: this user has full access and can delegate permissions to every service and resource in AWS. ### Use cases - The Administrator job function: a user who has full access and can delegate permissions to every service and resource in AWS. ### Prerequisites - Before an IAM user or role can access the AWS Billing and Cost Management console with the permissions in this policy, you must first activate IAM user and role access. ### Best practices - The IAM User Guide recommends using this policy only for the account administrator. - AWS managed policies don't grant least privilege permissions. To move toward least privilege, the IAM User Guide suggests using IAM Access Analyzer to monitor principals that have AWS managed policies, then writing a custom policy or generating a policy with only the permissions they use. ### Security considerations - The policy grants every action on every resource, including the ability to delegate permissions to every service and resource. AWS tells you to consider the security risk of granting principals more permissions than they need to do their job. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide recommends it only for the account administrator. For power users who need full access to every service except limited access to IAM and AWS Organizations, it points to the PowerUserAccess job function instead. ### FAQs **When should I attach AdministratorAccess?** The IAM User Guide recommends using it only for the account administrator. It is the Administrator job function, for a user who has full access and can delegate permissions to every service and resource in AWS. For power users who need full access except limited access to IAM and AWS Organizations, the guide points to PowerUserAccess. **What does AdministratorAccess grant?** Everything. The policy document is a single Allow statement with Action "*" and Resource "*", so it grants all actions for all AWS services and for all resources in the account. AWS describes it as providing full access to AWS services and resources. **What are the security risks of AdministratorAccess?** It grants full access and the ability to delegate permissions to every service and resource, so any identity that holds it can act on all of them. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. You also cannot change the policy, and AWS updates to it affect every identity it is attached to. ### Sources - [AdministratorAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AdministratorAccess-Amplify - Page: https://iampolicymap.com/policies/administratoraccess-amplify/ - ARN: `arn:aws:iam::aws:policy/AdministratorAccess-Amplify` - Kind: standard. Domain: privileged. Default version: v12. Guide reviewed against: v12. - Tier: admin; High privilege. Distinct granted actions: 545 control plane, 16 data plane, 25 unclassified. - AWS description: Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications. - Actions: https://iampolicymap.com/policies/administratoraccess-amplify/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: amplify (22 of 22), amplifybackend (22 of 22), amplifyuibuilder (14 of 14), geo (28 of 28), mobiletargeting (66 of 66). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole on all resources without conditions. - Grants permissions-management actions on iam on all resources without conditions. - 2 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Grants account administrative permissions while explicitly allowing direct access to resources needed by Amplify applications. The AWS Amplify Hosting User Guide says the policy grants account administrative permissions together with direct access to the resources that Amplify applications need to create and manage backends. ### Practical scope CloudFormation stack actions are allowed on stacks named amplify-*. A large statement allows IAM, AppSync, API Gateway, Cognito, Lambda, DynamoDB, S3, CloudFront, EventBridge, Kinesis and Elasticsearch actions on Resource "*" only when aws:CalledVia includes cloudformation.amazonaws.com. Another statement allows amplify:*, amplifybackend:*, amplifyuibuilder:*, mobiletargeting:* and sts:AssumeRole, together with Cognito, DynamoDB, Lambda, CloudFront, SNS, Lex, Polly and logging actions and a list of iam: role and policy actions including iam:CreateRole, iam:PassRole, iam:AttachRolePolicy and iam:PutRolePolicy, on all resources. Further statements allow S3 bucket and object actions, CloudFront, Lambda, Route 53 and SQS actions in statements named AmplifySSR*, geo:*, SSM parameter actions on parameter/amplify/*, and CloudWatch Logs actions on /aws/amplify/* log groups. ### Use cases - Serve as the permissions for the Amplify-Backend Deployment service role. The AWS Amplify Hosting User Guide says that when you deploy a backend in the Amplify console you must create that service role, and IAM attaches this policy to it. - Give an IAM identity administrator-level permissions to create and manage Amplify backends, where that scope is intended. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The AWS Amplify Hosting User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The AWS Amplify Hosting User Guide says the policy's IAM actions let identities create other identities with any permissions, which allows permissions escalation, and that the policy should be considered as powerful as the AdministratorAccess policy. - iam:PassRole is allowed on all resources. The User Guide says this is required to support Amazon Cognito user pools configuration. - The policy allows iam:CreateRole, iam:AttachRolePolicy, iam:PutRolePolicy and sts:AssumeRole on Resource "*" without a CalledVia condition. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The AWS Amplify Hosting User Guide also says Amplify attaches this policy to a service role that allows Amplify to perform actions on your behalf. The reference page links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. Treat it as administrator-level, as the User Guide advises. ### FAQs **When should I attach AdministratorAccess-Amplify?** The AWS Amplify Hosting User Guide says you can attach it to your IAM identities, and that Amplify attaches it to the Amplify-Backend Deployment service role you create when you deploy a backend in the Amplify console. Attach it to people only where administrator-level Amplify backend work is intended. **What does AdministratorAccess-Amplify grant?** It allows amplify:*, amplifybackend:*, amplifyuibuilder:*, mobiletargeting:* and geo:*, CloudFormation actions on amplify-* stacks, and actions across IAM, AppSync, API Gateway, Cognito, Lambda, DynamoDB, S3, CloudFront, EventBridge, Kinesis and related services (many only when called via CloudFormation), plus SSM parameters under parameter/amplify/* and logs under /aws/amplify/*. **What are the security risks of AdministratorAccess-Amplify?** The AWS Amplify Hosting User Guide warns that the IAM actions let identities create other identities with any permissions, allowing permissions escalation, and that the policy should be considered as powerful as AdministratorAccess. iam:PassRole applies to all resources. AWS managed policies do not grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AdministratorAccess-Amplify (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess-Amplify.md), retrieved 2026-11-13 - [AWS managed policies for AWS Amplify (AWS Amplify Hosting User Guide)](https://docs.aws.amazon.com/amplify/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AgentRegistryFullAccess - Page: https://iampolicymap.com/policies/agentregistryfullaccess/ - ARN: `arn:aws:iam::aws:policy/AgentRegistryFullAccess` - Kind: standard. Domain: ai-machine-learning. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 37 control plane, 3 data plane, 4 unclassified. - AWS description: Provides full access to AWS Agent Registry - Actions: https://iampolicymap.com/policies/agentregistryfullaccess/actions.json ### Tier reasons - Grants 24 write, tagging or permissions-management actions, short of full control of any service. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to AWS Agent Registry. ### Practical scope Twelve statements. AgentRegistryFullAccess allows agent-registry:* on arn:aws:agent-registry:*:*:*. AgentRegistryPassRoleAccess allows iam:PassRole on all roles, only when passed to agent-registry.amazonaws.com. Statements for bedrock-agentcore allow four workload identity actions, bedrock-agentcore:GetResourceOauth2Token and bedrock-agentcore:ListOauth2CredentialProviders. IAMListAccess allows iam:ListRoles. Four statements allow kms actions on keys (kms:Decrypt, kms:DescribeKey, kms:Encrypt, kms:GenerateDataKey, kms:GenerateDataKeyWithoutPlaintext, kms:ReEncryptFrom, kms:ReEncryptTo and kms:CreateGrant) under via-service, called-via or encryption context conditions. AgentRegistrySecretsManagerAccess allows secretsmanager:GetSecretValue on arn:aws:secretsmanager:*:*:secret:*. AgentRegistryServiceLinkedRoleAccess allows iam:CreateServiceLinkedRole for agent-registry.amazonaws.com. ### Use cases - Give users or roles full access to AWS Agent Registry, including the related access the policy lists for it. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - secretsmanager:GetSecretValue is allowed on arn:aws:secretsmanager:*:*:secret:* with no condition, so a principal with this policy can read the value of any secret that matches that pattern, which is every secret ARN, not only secrets for AWS Agent Registry. - iam:PassRole is allowed on every role (arn:aws:iam::*:role/*) but only to agent-registry.amazonaws.com. Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - agent-registry:* is full access to that service's actions on all of its resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to AWS Agent Registry is intended. ### FAQs **When should I attach AgentRegistryFullAccess?** The reference page says you can attach AgentRegistryFullAccess to your users, groups and roles, and describes it as full access to AWS Agent Registry. Attach it only for people who administer the registry. **What does AgentRegistryFullAccess grant?** It allows agent-registry:* on Agent Registry resources, passing any role to agent-registry.amazonaws.com, bedrock-agentcore workload identity and OAuth2 credential actions, conditioned kms actions, secretsmanager:GetSecretValue on all secrets, iam:ListRoles and creating the Agent Registry service-linked role. **What are the security risks of AgentRegistryFullAccess?** secretsmanager:GetSecretValue is unconditioned on all secrets, and iam:PassRole covers every role when passed to agent-registry.amazonaws.com. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AgentRegistryFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AgentRegistryFullAccess.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonAuroraDSQLConsoleFullAccess - Page: https://iampolicymap.com/policies/amazonauroradsqlconsolefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonAuroraDSQLConsoleFullAccess` - Kind: standard. Domain: databases. Default version: v16. Guide reviewed against: v16. - Tier: admin. Distinct granted actions: 45 control plane, 2 data plane, 10 unclassified. - AWS description: Provides console full administrative access to Aurora DSQL - Actions: https://iampolicymap.com/policies/amazonauroradsqlconsolefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: dsql (19 of 19). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 8 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides console full administrative access to Aurora DSQL. The Aurora DSQL User Guide says principals with it can create, delete and update Aurora DSQL clusters, including multi-Region clusters, and manage cluster inline policies through the AWS Management Console. ### Practical scope The DsqlAllPermissions statement allows dsql actions on Resource "*", including dsql:CreateCluster, dsql:UpdateCluster, dsql:DeleteCluster, dsql:DbConnectAdmin, dsql:DbConnect, dsql:PutClusterPolicy, dsql:DeleteClusterPolicy, the backup and restore job actions, the stream actions and dsql:InjectError. DsqlConsolePermissions allows access-analyzer:ValidatePolicy, tag:GetTagKeys, tag:GetTagValues, cloudwatch:GetMetricData, cloudwatch:ListMetrics, ec2:DescribeVpcEndpoints, kms:ListAliases, kms:DescribeKey, kinesis:DescribeStreamSummary and kinesis:ListStreams. KMSCryptographicPermissions allows kms:Decrypt, kms:Encrypt, kms:GenerateDataKey, kms:ReEncryptTo and kms:ReEncryptFrom when kms:ViaService matches dsql.*.amazonaws.com and the encryption context keys include aws:dsql:ClusterId. It also allows iam:CreateServiceLinkedRole when iam:AWSServiceName is dsql.amazonaws.com, and iam:PassRole when iam:PassedToService is dsql.amazonaws.com. ### Use cases - Give an administrator full access to manage Aurora DSQL clusters in the AWS Management Console, including multi-Region clusters, cluster inline policies, and backup and restore operations. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The Aurora DSQL User Guide says principals can connect to the database as any user, including the admin. The policy allows dsql:DbConnectAdmin and dsql:DbConnect on all resources. - The policy allows destructive actions on Resource "*", including dsql:DeleteCluster, dsql:DeleteClusterPolicy and dsql:DeleteStream. - The PassRoleForChangeStreams statement allows iam:PassRole on Resource "*" when iam:PassedToService is dsql.amazonaws.com. The IAM User Guide says to make sure a user cannot pass a role that has more permissions than you want the user to have. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It is intended for administrators who manage Aurora DSQL through the console. ### FAQs **When should I attach AmazonAuroraDSQLConsoleFullAccess?** The Aurora DSQL User Guide says you can attach it to your users, groups and roles. Attach it for administrators who need full administrative access to Aurora DSQL through the AWS Management Console, including creating, updating and deleting clusters. **What does AmazonAuroraDSQLConsoleFullAccess grant?** It allows dsql actions on all resources, covering clusters, cluster policies, tags, database connections, multi-Region properties, backup and restore jobs and streams. It also allows console support actions for CloudWatch metrics, tags, VPC endpoints and KMS, conditioned KMS cryptographic actions, creating the dsql.amazonaws.com service-linked role and passing roles to dsql.amazonaws.com. **What are the security risks of AmazonAuroraDSQLConsoleFullAccess?** Principals can connect to the database as any user, including the admin, and can delete clusters, cluster policies and streams on all resources. The policy allows iam:PassRole to dsql.amazonaws.com on any role. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonAuroraDSQLConsoleFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonAuroraDSQLConsoleFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Aurora DSQL](https://docs.aws.amazon.com/aurora-dsql/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonBedrockFullAccess - Page: https://iampolicymap.com/policies/amazonbedrockfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonBedrockFullAccess` - Kind: standard. Domain: ai-machine-learning. Default version: v11. Guide reviewed against: v11. - Tier: admin. Distinct granted actions: 297 control plane, 38 data plane, 58 unclassified. - AWS description: Provides full access to Amazon Bedrock as well as limited access to related services that are required by it - Actions: https://iampolicymap.com/policies/amazonbedrockfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: bedrock (136 of 136), bedrock-mantle (18 of 18). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Amazon Bedrock as well as limited access to related services that are required by it. The Amazon Bedrock User Guide says it grants administrative permissions to create, read, update and delete Amazon Bedrock resources. ### Practical scope bedrock:* and bedrock-mantle:* are allowed on Resource "*", and bedrock-websearch:InvokeSearch and InvokeFetch on bedrock-websearch resources. The User Guide lists ec2 (describe VPCs, subnets and security groups), iam (pass roles), kms (describe keys and aliases) and sagemaker (resources that underpin the Amazon Bedrock Marketplace feature). The SageMaker endpoint, endpoint-config and model create, update, delete, describe and invoke actions are conditioned on aws:CalledViaLast equal to bedrock.amazonaws.com (some also on a resource tag), and sagemaker:AddTags and sagemaker:DeleteTags are limited by tag keys and values. iam:PassRole is allowed for roles matching *AmazonBedrock* when passed to bedrock.amazonaws.com, and for roles matching *SageMaker*ForBedrock* when passed to sagemaker.amazonaws.com or bedrock.amazonaws.com. aws-marketplace:Subscribe, Unsubscribe and ViewSubscriptions are allowed only when called via Amazon Bedrock. ### Use cases - Give administrators permission to create, read, update and delete Amazon Bedrock resources. - Use Amazon Bedrock Marketplace models, which depend on the Amazon SageMaker AI resources the policy covers. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - bedrock:* and bedrock-mantle:* allow every action in those services on all resources. The User Guide describes the policy as administrative permissions to create, read, update and delete Amazon Bedrock resources. - aws-marketplace:Subscribe, aws-marketplace:Unsubscribe and aws-marketplace:ViewSubscriptions are allowed on all resources when aws:CalledViaLast equals bedrock.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where administrative Amazon Bedrock access is intended. Where a narrower scope is needed, the Amazon Bedrock User Guide also lists AmazonBedrockReadOnly and AmazonBedrockLimitedAccess. ### FAQs **When should I attach AmazonBedrockFullAccess?** The Amazon Bedrock User Guide says you can attach it to your IAM identities to grant administrative permissions to create, read, update and delete Amazon Bedrock resources. Attach it where that scope is intended. The User Guide also lists AmazonBedrockReadOnly and AmazonBedrockLimitedAccess for narrower access. **What does AmazonBedrockFullAccess grant?** It allows bedrock:* and bedrock-mantle:* on all resources, Bedrock web search invoke actions, kms:DescribeKey, iam:ListRoles and EC2 describe actions for VPCs, subnets and security groups, SageMaker endpoint, model and hub-content actions that support Amazon Bedrock Marketplace models (many only when called via Amazon Bedrock), iam:PassRole for Amazon Bedrock and SageMaker-for-Bedrock roles, and AWS Marketplace subscribe and unsubscribe when called via Amazon Bedrock. **What are the security risks of AmazonBedrockFullAccess?** bedrock:* and bedrock-mantle:* allow every action in those services on all resources, and aws-marketplace:Subscribe and Unsubscribe are allowed when called via Amazon Bedrock. iam:PassRole is limited to roles with matching names and services. AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonBedrockFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Bedrock (Amazon Bedrock User Guide)](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonBedrockReadOnly - Page: https://iampolicymap.com/policies/amazonbedrockreadonly/ - ARN: `arn:aws:iam::aws:policy/AmazonBedrockReadOnly` - Kind: standard. Domain: ai-machine-learning. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 109 control plane, 10 data plane, 5 unclassified. - AWS description: Provides read only access to Amazon Bedrock - Actions: https://iampolicymap.com/policies/amazonbedrockreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon Bedrock. The Amazon Bedrock User Guide says it grants read-only permissions to view all resources in Amazon Bedrock. ### Practical scope bedrock:Get* and bedrock:List* are allowed on Resource "*". Six sagemaker actions (DescribeEndpoint, DescribeEndpointConfig, DescribeModel, DescribeInferenceComponent, ListEndpoints and ListTags) are allowed on SageMaker endpoint, endpoint-config and model resources only when aws:CalledViaLast equals bedrock.amazonaws.com. sagemaker:DescribeHubContent and sagemaker:ListHubContents are allowed on the SageMakerPublicHub resources. ### Use cases - Give users read-only access to view all resources in Amazon Bedrock. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - bedrock:Get* and bedrock:List* apply to all resources. The User Guide describes the policy as read-only access to view all Amazon Bedrock resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only Amazon Bedrock access is intended. ### FAQs **When should I attach AmazonBedrockReadOnly?** The Amazon Bedrock User Guide says you can attach it to your IAM identities to grant read-only permissions to view all resources in Amazon Bedrock. Attach it to people who need to see but not change Amazon Bedrock resources. **What does AmazonBedrockReadOnly grant?** It allows bedrock:Get* and bedrock:List* on all resources, six SageMaker describe and list actions on endpoint, endpoint-config and model resources when called via Amazon Bedrock, and SageMaker hub-content describe and list actions on the public hub. **What are the security risks of AmazonBedrockReadOnly?** The policy has no write actions, but bedrock:Get* and bedrock:List* apply to all resources. The IAM User Guide says AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonBedrockReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Bedrock (Amazon Bedrock User Guide)](https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonBioDiscoveryFullAccess - Page: https://iampolicymap.com/policies/amazonbiodiscoveryfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonBioDiscoveryFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 40 control plane, 1 data plane, 7 unclassified. - AWS description: Allows full administrative access to Amazon Bio Discovery - Actions: https://iampolicymap.com/policies/amazonbiodiscoveryfullaccess/actions.json ### Tier reasons - Grants 17 write, tagging or permissions-management actions, short of full control of any service. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Allows full administrative access to Amazon Bio Discovery. The policy also includes related permissions for IAM Identity Center and the identity store, EC2 networking, S3 and AWS KMS. ### Practical scope 10 statements, all Allow. AmazonBioDiscoveryFullAccess allows researchstudio:* on Resource "*". Other statements allow 21 sso actions (application creation, assignment, grants, authentication methods and access scopes) on instance and application ARNs, 5 identitystore read actions, iam:PassRole, iam:CreateServiceLinkedRole, three EC2 describe actions (ec2:DescribeVpcs, ec2:DescribeSubnets, ec2:DescribeSecurityGroups), s3:ListAllMyBuckets, s3:ListBucket and s3:GetEncryptionConfiguration, and two kms:Decrypt statements with conditions. ### Use cases - Give administrators full administrative access to Amazon Bio Discovery. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - researchstudio:* on Resource "*" allows every Amazon Bio Discovery action, not only reads. - It includes IAM Identity Center write actions on application resources, such as sso:CreateApplication, sso:DeleteApplication, sso:CreateApplicationAssignment, sso:PutApplicationGrant and sso:PutApplicationAuthenticationMethod. - iam:PassRole is allowed on arn:aws:iam::*:role/* with a StringEquals condition on iam:PassedToService (researchstudio.amazonaws.com). The IAM User Guide warns that a passed role can have more permissions than the person passing it. - It allows iam:CreateServiceLinkedRole on arn:aws:iam::*:role/aws-service-role/researchstudio.amazonaws.com/AWSServiceRoleForAmazonBioDiscovery, and s3:ListBucket and s3:GetEncryptionConfiguration on arn:aws:s3:::* with a StringEquals condition on aws:ResourceAccount (${aws:PrincipalAccount}). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full administrative access to Amazon Bio Discovery is intended. ### FAQs **When should I attach AmazonBioDiscoveryFullAccess?** The reference page says you can attach AmazonBioDiscoveryFullAccess to your users, groups and roles, and describes it as: allows full administrative access to Amazon Bio Discovery. Attach it where administering Amazon Bio Discovery is the intended scope. **What does AmazonBioDiscoveryFullAccess grant?** It allows researchstudio:* on all resources, 21 IAM Identity Center sso actions on application ARNs, identitystore read actions, iam:PassRole to researchstudio.amazonaws.com, creation of the Amazon Bio Discovery service-linked role, EC2 describe actions, S3 bucket listing and encryption configuration reads, and kms:Decrypt through IAM Identity Center and the identity store. **What are the security risks of AmazonBioDiscoveryFullAccess?** researchstudio:* allows every Bio Discovery action, it can create and delete IAM Identity Center applications, and it can pass roles to the service. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonBioDiscoveryFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBioDiscoveryFullAccess.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonBioDiscoveryInAppFullAccess - Page: https://iampolicymap.com/policies/amazonbiodiscoveryinappfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 13 control plane, 0 data plane, 6 unclassified. - AWS description: Provides full access to actions within the Amazon Bio Discovery applications - Actions: https://iampolicymap.com/policies/amazonbiodiscoveryinappfullaccess/actions.json ### Tier reasons - Grants 7 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides full access to actions within the Amazon Bio Discovery applications. ### Practical scope Five statements. AmazonBioDiscoveryInAppFullAccess allows researchstudio:* on Resource "*". AmazonBioDiscoveryIdentityStoreInAppAccess allows identitystore:ListGroupMembershipsForMember, identitystore:ListGroups and identitystore:ListUsers on identity store resources. AmazonBioDiscoveryIdentityCenterInAppAccess allows sso:CreateApplicationAssignment, sso:DeleteApplicationAssignment and sso:ListApplicationAssignments on IAM Identity Center instances and applications. Two statements allow kms:Decrypt on all keys only when the call is made via sso or identitystore and the encryption context matches an Identity Center instance or identity store. ### Use cases - Let users work within the Amazon Bio Discovery applications, including managing which Identity Center users and groups are assigned to them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - sso:CreateApplicationAssignment and sso:DeleteApplicationAssignment apply to all IAM Identity Center applications (arn:aws:sso::*:application/*/*), not only Amazon Bio Discovery ones, so a principal can change who is assigned to them. - researchstudio:* on all resources is full access to that service's actions. kms:Decrypt is limited by conditions to calls made via IAM Identity Center or the identity store. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access within the Amazon Bio Discovery applications is intended. ### FAQs **When should I attach AmazonBioDiscoveryInAppFullAccess?** The reference page says you can attach AmazonBioDiscoveryInAppFullAccess to your users, groups and roles, and describes it as full access to actions within the Amazon Bio Discovery applications. Attach it for users who work in those applications. **What does AmazonBioDiscoveryInAppFullAccess grant?** It allows researchstudio:* on all resources, three identitystore list actions, three IAM Identity Center application assignment actions (create, delete and list) and kms:Decrypt under via-service conditions. **What are the security risks of AmazonBioDiscoveryInAppFullAccess?** The application assignment actions apply to all IAM Identity Center applications, so a principal can change who is assigned to them. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonBioDiscoveryInAppFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBioDiscoveryInAppFullAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonDataZoneProjectDeploymentPermissionsBoundary - Page: https://iampolicymap.com/policies/amazondatazoneprojectdeploymentpermissionsboundary/ - ARN: `arn:aws:iam::aws:policy/AmazonDataZoneProjectDeploymentPermissionsBoundary` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: operator; High privilege. Distinct granted actions: 431 control plane, 17 data plane, 32 unclassified. - AWS description: Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. DataZone uses this policy when creating these roles to define the boundary of their permissions. - Actions: https://iampolicymap.com/policies/amazondatazoneprojectdeploymentpermissionsboundary/actions.json ### Tier reasons - Grants 72 write, tagging or permissions-management actions, short of full control of any service. - Grants permissions-management actions on iam on all resources without conditions. - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Amazon DataZone creates IAM roles that it uses for deploying data analytics projects. The reference page says DataZone uses this policy when creating these roles to define the boundary of their permissions. ### Practical scope The policy allows iam:CreateRole, iam:AttachRolePolicy, iam:PutRolePolicy, iam:DetachRolePolicy and iam:DeleteRolePolicy on roles whose names contain "datazone", only when iam:PermissionsBoundary is arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary. It also allows iam:DeleteRole and iam:PassRole on those roles. Other statements allow S3 actions on buckets whose names contain "datazone" in the calling account, SSM parameter actions, and KMS, Athena, EC2 security group, CloudWatch Logs, Lake Formation and AWS Glue actions, several limited by datazone tags. kms:PutKeyPolicy is allowed only when called via cloudformation.amazonaws.com. Some statements apply to Resource "*". ### Use cases - Review the boundary that Amazon DataZone applies to the roles it creates for deploying data analytics projects. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy is not read-only. For roles whose names contain "datazone" it allows creating and deleting roles and changing their attached and inline policies (iam:CreateRole, iam:DeleteRole, iam:AttachRolePolicy, iam:PutRolePolicy), and it allows iam:PassRole. - Several statements apply to Resource "*" with no datazone tag condition, including iam:CreatePolicy, lakeformation:GrantPermissions, lakeformation:PutDataLakeSettings, ec2:CreateSecurityGroup, ec2:DeleteSecurityGroup and logs:DeleteLogGroup. - A permissions boundary limits the maximum permissions of a user or role and does not provide permissions on its own. The IAM User Guide says an entity can perform only the actions allowed by both its identity-based policies and its permissions boundary. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance The description says DataZone uses this policy when it creates the roles for deploying data analytics projects, to define the boundary of their permissions. The reference page also says you can attach it to your users, groups and roles. The IAM User Guide says you can use an AWS managed policy to set the boundary for a user or role. Because a boundary does not provide permissions on its own, it gives no access without an identity-based policy. ### FAQs **When should I attach AmazonDataZoneProjectDeploymentPermissionsBoundary?** The description says DataZone uses it when creating the roles it uses for deploying data analytics projects, to define the boundary of their permissions. The reference page says you can attach it to your users, groups and roles. As a boundary it limits permissions and does not provide them, so it does not replace a permissions policy. **What does AmazonDataZoneProjectDeploymentPermissionsBoundary grant?** It allows IAM role management on roles whose names contain "datazone" (creating roles and attaching policies only with the DataZone project role boundary set), plus S3, SSM, KMS, Athena, EC2 security group, CloudWatch Logs, Lake Formation and AWS Glue actions, several limited by name patterns or datazone tags. Used as a permissions boundary it sets a maximum and does not provide permissions on its own. **What are the security risks of AmazonDataZoneProjectDeploymentPermissionsBoundary?** It includes write actions, including IAM role creation and deletion, iam:PassRole, lakeformation:GrantPermissions and ec2:DeleteSecurityGroup, and several of them apply to Resource "*". AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonDataZoneProjectDeploymentPermissionsBoundary (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDataZoneProjectDeploymentPermissionsBoundary.md), retrieved 2026-11-13 - [Permissions boundaries for IAM entities (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonDocDBElasticFullAccess - Page: https://iampolicymap.com/policies/amazondocdbelasticfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonDocDBElasticFullAccess` - Kind: standard. Domain: databases. Default version: v8. Guide reviewed against: v8. - Tier: admin. Distinct granted actions: 38 control plane, 3 data plane, 0 unclassified. - AWS description: Provides full access to Amazon DocumentDB Elastic Clusters and other required permissions for its dependencies including EC2, KMS, SecretsManager, CloudWatch and IAM. - Actions: https://iampolicymap.com/policies/amazondocdbelasticfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: docdb-elastic (10 of 10). ### Summary Provides full access to Amazon DocumentDB Elastic Clusters and other required permissions for its dependencies, including EC2, KMS, Secrets Manager, CloudWatch and IAM, as the AWS Managed Policy Reference Guide describes it. ### Practical scope The DocdbElasticSid statement allows 19 docdb-elastic actions on Resource "*", including CreateCluster, UpdateCluster, DeleteCluster, DeleteClusterSnapshot, RestoreClusterFromSnapshot, StartCluster and StopCluster. EC2 VPC endpoint and describe actions plus secretsmanager:ListSecrets are allowed only when the call is made first through docdb-elastic.amazonaws.com. kms:Decrypt, kms:DescribeKey, kms:GenerateDataKey and kms:CreateGrant are allowed only through docdb-elastic and on resources tagged with the DocDBElasticFullAccess tag key. secretsmanager:ListSecretVersionIds, DescribeSecret, GetSecretValue and GetResourcePolicy are allowed on tagged secrets when called through docdb-elastic. cloudwatch:GetMetricData, ListMetrics and GetMetricStatistics are allowed on all resources. iam:CreateServiceLinkedRole is allowed only for AWSServiceRoleForDocDB-Elastic with the docdb-elastic.amazonaws.com service name. ### Use cases - Create, change, snapshot, restore, start, stop and delete Amazon DocumentDB elastic clusters. ### Prerequisites - If you use a secret or a customer managed key with this policy, tag it with the tag key DocDBElasticFullAccess and a tag value. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The docdb-elastic actions on all resources include DeleteCluster and DeleteClusterSnapshot. - The KMS and Secrets Manager grants include kms:Decrypt and secretsmanager:GetSecretValue, but only through docdb-elastic and only for resources carrying the DocDBElasticFullAccess tag key. The Amazon DocumentDB Developer Guide says the policy uses tags within conditions to scope access to resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon DocumentDB Developer Guide describes it as full access to all Amazon DocumentDB elastic cluster resources for the root AWS account. It fits where that scope is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonDocDBElasticFullAccess?** The reference description says it provides full access to Amazon DocumentDB Elastic Clusters and the dependency permissions they need. You can attach it to users, groups and roles that manage elastic clusters. Tag any secret or customer managed key you use with the DocDBElasticFullAccess tag key. **What does AmazonDocDBElasticFullAccess grant?** It allows 19 docdb-elastic actions on all resources, EC2 VPC endpoint actions, KMS and Secrets Manager actions through docdb-elastic on tagged resources, CloudWatch metric reads, and creating the AWSServiceRoleForDocDB-Elastic service-linked role. **What are the security risks of AmazonDocDBElasticFullAccess?** docdb-elastic actions, including DeleteCluster, apply to all resources. The KMS decrypt and secret read grants are limited by service and tag conditions. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonDocDBElasticFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDocDBElasticFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon DocumentDB (Amazon DocumentDB Developer Guide)](https://docs.aws.amazon.com/documentdb/latest/developerguide/docdb-managed-policies.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonDocDBReadOnlyAccess - Page: https://iampolicymap.com/policies/amazondocdbreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonDocDBReadOnlyAccess` - Kind: standard. Domain: databases. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 33 control plane, 2 data plane, 0 unclassified. - AWS description: Provides read-only access to Amazon DocumentDB with MongoDB compatibility. Note that this policy also grants access to Amazon RDS and Amazon Neptune resources. - Actions: https://iampolicymap.com/policies/amazondocdbreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Amazon DocumentDB with MongoDB compatibility. The reference page notes that this policy also grants access to Amazon RDS and Amazon Neptune resources. The Amazon DocumentDB Developer Guide says principals with it cannot make updates, delete existing resources or create new DocumentDB resources. ### Practical scope On Resource "*" the policy allows rds:DescribeAccountAttributes, rds:DescribeCertificates, rds:DescribeDBClusterParameterGroups, rds:DescribeDBClusterParameters, rds:DescribeDBClusterSnapshotAttributes, rds:DescribeDBClusterSnapshots, rds:DescribeDBClusters, rds:DescribeDBEngineVersions, rds:DescribeDBInstances, rds:DescribeDBLogFiles, rds:DescribeDBParameterGroups, rds:DescribeDBParameters, rds:DescribeDBSubnetGroups, rds:DescribeEventCategories, rds:DescribeEventSubscriptions, rds:DescribeEvents, rds:DescribeOrderableDBInstanceOptions, rds:DescribePendingMaintenanceActions, rds:DownloadDBLogFilePortion and rds:ListTagsForResource. It also allows cloudwatch:GetMetricStatistics, cloudwatch:ListMetrics, seven ec2 Describe actions, and kms:ListKeys, kms:ListRetirableGrants, kms:ListAliases and kms:ListKeyPolicies. logs:DescribeLogStreams and logs:GetLogEvents are allowed only on log streams in log groups under /aws/rds/ and /aws/docdb/. ### Use cases - Let users view the list of Amazon DocumentDB clusters and their configurations without being able to change them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy has no create, update or delete actions, but its actions use the rds, cloudwatch, ec2, kms and logs prefixes. The reference description says it also grants access to Amazon RDS and Amazon Neptune resources. - rds:DownloadDBLogFilePortion on Resource "*" and logs:GetLogEvents let principals read database log content. Only the two logs actions are limited to log groups under /aws/rds/ and /aws/docdb/. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only visibility of DocumentDB clusters and their configuration is intended. ### FAQs **When should I attach AmazonDocDBReadOnlyAccess?** The Amazon DocumentDB Developer Guide says it allows users to view information in Amazon DocumentDB. Attach it where viewing clusters and configurations, without changing them, is the intended scope. **What does AmazonDocDBReadOnlyAccess grant?** On all resources it allows rds Describe actions, rds:DownloadDBLogFilePortion and rds:ListTagsForResource, two CloudWatch metric read actions, seven EC2 Describe actions and four KMS list actions. It allows logs:DescribeLogStreams and logs:GetLogEvents only on log streams under /aws/rds/ and /aws/docdb/. **What are the security risks of AmazonDocDBReadOnlyAccess?** The policy grants no write actions, but the reference description says it also grants access to Amazon RDS and Amazon Neptune resources, and it allows reading database log content. An AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonDocDBReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDocDBReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon DocumentDB](https://docs.aws.amazon.com/documentdb/latest/developerguide/docdb-managed-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonDynamoDBFullAccess - Page: https://iampolicymap.com/policies/amazondynamodbfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess` - Kind: standard. Domain: privileged. Default version: v15. Guide reviewed against: v15. - Tier: admin; High privilege. Distinct granted actions: 154 control plane, 20 data plane, 22 unclassified. - AWS description: Provides full access to Amazon DynamoDB via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazondynamodbfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: dax (16 of 16), dynamodb (45 of 45). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 13 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon DynamoDB via the AWS Management Console. The Amazon DynamoDB Developer Guide says this policy is deprecated and no longer recommended, and that it was replaced by a scoped-down policy named AmazonDynamoDBFullAccess_v2. ### Practical scope The first statement allows dynamodb:* and dax:* with a list of related actions on Resource "*", including datapipeline:CreatePipeline and datapipeline:DeletePipeline, lambda:CreateFunction and lambda:DeleteFunction, sns:CreateTopic and sns:DeleteTopic, and application-autoscaling and CloudWatch alarm actions. iam:PassRole is allowed on Resource "*" only when iam:PassedToService matches Application Auto Scaling or dax.amazonaws.com, and iam:CreateServiceLinkedRole only for named DynamoDB-related services. ### Use cases - Give users, groups or roles full access to DynamoDB through the console. AWS says the policy is deprecated, so check AmazonDynamoDBFullAccess_v2 first. ### Prerequisites None. ### Best practices - The best practice is to create custom IAM policies that grant least privilege to the users, roles or groups that require them. ### Security considerations - dynamodb:* and dax:* allow every DynamoDB and DAX action on all resources. The policy also allows lambda:CreateFunction, lambda:DeleteFunction, sns:DeleteTopic and datapipeline:DeletePipeline on all resources. - AWS marked AmazonDynamoDBFullAccess as deprecated on April 28, 2025 and no longer recommends it. A deprecated policy still applies to every identity it is attached to. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon DynamoDB Developer Guide says the policy is deprecated and no longer recommended; AmazonDynamoDBFullAccess_v2 is the scoped-down replacement it names. ### FAQs **When should I attach AmazonDynamoDBFullAccess?** The Amazon DynamoDB Developer Guide says AmazonDynamoDBFullAccess is deprecated and no longer recommended, and names AmazonDynamoDBFullAccess_v2 as the scoped-down replacement. If you already use it, review whether the v2 policy or a customer managed policy fits. **What does AmazonDynamoDBFullAccess grant?** It allows dynamodb:* and dax:* on all resources, plus related actions for Application Auto Scaling, CloudWatch alarms, AWS Data Pipeline, Amazon EC2 and IAM reads, AWS KMS reads, Amazon SNS topics, Lambda functions, AWS Resource Groups, tagging and Kinesis reads. It also allows iam:PassRole to Application Auto Scaling and dax.amazonaws.com, and creating service-linked roles for named services. **What are the security risks of AmazonDynamoDBFullAccess?** dynamodb:* and dax:* allow every DynamoDB and DAX action on all resources, together with delete actions such as lambda:DeleteFunction and sns:DeleteTopic. The policy is deprecated. AWS recommends custom IAM policies that grant least privilege, and updates to the policy affect every identity it is attached to. ### Sources - [AmazonDynamoDBFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDynamoDBFullAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon DynamoDB (Amazon DynamoDB Developer Guide)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ddb-security-iam.awsmanpol.md), retrieved 2026-11-12 - [Using identity-based policies (IAM policies) for Amazon DynamoDB (Amazon DynamoDB Developer Guide)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/using-identity-based-policies.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonDynamoDBFullAccess_v2 - Page: https://iampolicymap.com/policies/amazondynamodbfullaccess_v2/ - ARN: `arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess_v2` - Kind: standard. Domain: privileged. Default version: v3. Guide reviewed against: v3. - Tier: admin; High privilege. Distinct granted actions: 121 control plane, 19 data plane, 22 unclassified. - AWS description: Provides full access to Amazon DynamoDB - Actions: https://iampolicymap.com/policies/amazondynamodbfullaccess_v2/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: dax (16 of 16), dynamodb (45 of 45). - Grants data-plane write actions on a data store on all resources without conditions. - 13 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon DynamoDB. The Amazon DynamoDB Developer Guide calls it a scoped-down policy that grants administrative access to DynamoDB resources and to the AWS services DynamoDB is integrated with, and says it replaced the deprecated AmazonDynamoDBFullAccess. ### Practical scope The DDBAndDAXFullAccess statement allows dynamodb:* and dax:* on Resource "*". Further statements on "*" allow limited actions for AWS KMS (kms:DescribeKey, kms:ListAliases), Lambda (lambda:ListEventSourceMappings, lambda:ListFunctions), SNS (sns:ListTopics), Application Auto Scaling, tag:GetResources, CloudWatch, Kinesis list and describe actions, EC2 describe actions for VPCs, subnets and security groups, and iam:ListRoles. The Application Auto Scaling write actions apply only when application-autoscaling:service-namespace is dynamodb. iam:CreateServiceLinkedRole is allowed only for five named DynamoDB-related service names. ### Use cases - Give users, groups or roles full access to Amazon DynamoDB, including DynamoDB Accelerator, with the supporting access the console needs. The Developer Guide names AmazonDynamoDBFullAccess_v2 as the replacement for the deprecated AmazonDynamoDBFullAccess. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - dynamodb:* and dax:* allow every DynamoDB and DynamoDB Accelerator action on all resources. - The policy also allows iam:CreateServiceLinkedRole for replication.dynamodb.amazonaws.com, dax.amazonaws.com, dynamodb.application-autoscaling.amazonaws.com, contributorinsights.dynamodb.amazonaws.com and kinesisreplication.dynamodb.amazonaws.com, and Application Auto Scaling policy and target changes for the dynamodb namespace. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon DynamoDB Developer Guide says you can attach it to your IAM identities. It fits where full access to DynamoDB is intended. ### FAQs **When should I attach AmazonDynamoDBFullAccess_v2?** The Amazon DynamoDB Developer Guide says you can attach it to your IAM identities, and that it grants administrative access to DynamoDB resources and to the services DynamoDB is integrated with for all DynamoDB features available in the console. The guide says it replaced the deprecated AmazonDynamoDBFullAccess. **What does AmazonDynamoDBFullAccess_v2 grant?** It allows dynamodb:* and dax:* on all resources, plus limited KMS, Lambda, SNS, Application Auto Scaling, tagging, CloudWatch, Kinesis, EC2 describe and iam:ListRoles actions, and iam:CreateServiceLinkedRole for five named services. **What are the security risks of AmazonDynamoDBFullAccess_v2?** dynamodb:* and dax:* allow every DynamoDB and DynamoDB Accelerator action on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonDynamoDBFullAccess_v2 (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDynamoDBFullAccess_v2.md), retrieved 2026-11-13 - [AWS managed policies for Amazon DynamoDB (Amazon DynamoDB Developer Guide)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ddb-security-iam.awsmanpol.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonDynamoDBFullAccesswithDataPipeline - Page: https://iampolicymap.com/policies/amazondynamodbfullaccesswithdatapipeline/ - ARN: `arn:aws:iam::aws:policy/AmazonDynamoDBFullAccesswithDataPipeline` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: admin; High privilege. Distinct granted actions: 423 control plane, 52 data plane, 68 unclassified. - AWS description: This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBPipeline.html. Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pip… - Actions: https://iampolicymap.com/policies/amazondynamodbfullaccesswithdatapipeline/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: datapipeline (11 of 11), dynamodb (45 of 45), elasticmapreduce (54 of 54), lambda (76 of 76). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole on all resources without conditions. - 17 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon DynamoDB including Export/Import using AWS Data Pipeline via the AWS Management Console. The reference page description says this policy is on a deprecation path. ### Practical scope dynamodb:*, lambda:*, datapipeline:* and elasticmapreduce:* are allowed on Resource "*". The policy also allows CloudWatch alarm actions, SNS topic and subscription actions, EC2 actions (CreateTags, DescribeInstances, RunInstances, StartInstances, StopInstances, TerminateInstances), iam:ListRoles, iam:GetRolePolicy and iam:PassRole on all resources with no condition, and s3:DeleteObject, s3:Get*, s3:List* and s3:Put* on all resources. ### Use cases - Give users, groups or roles full access to DynamoDB, including export and import with AWS Data Pipeline, through the console. The description says the policy is on a deprecation path, so check current DynamoDB policies first. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy is on a deprecation path according to its description. - iam:PassRole is allowed on all resources with no condition, and lambda:*, datapipeline:*, elasticmapreduce:* and s3:Put* and s3:DeleteObject are allowed on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. Its description says the policy is on a deprecation path, so check current DynamoDB policies before attaching it to new identities. ### FAQs **When should I attach AmazonDynamoDBFullAccesswithDataPipeline?** Its description says it provides full access to DynamoDB including export and import with AWS Data Pipeline via the console, and that the policy is on a deprecation path. If you already use it, review whether a current DynamoDB policy or a customer managed policy fits. **What does AmazonDynamoDBFullAccesswithDataPipeline grant?** It allows dynamodb:*, lambda:*, datapipeline:* and elasticmapreduce:* on all resources, CloudWatch alarm actions, SNS topic and subscription actions, EC2 instance launch, start, stop and terminate actions, iam:ListRoles, iam:GetRolePolicy and iam:PassRole, and S3 delete, get, list and put actions, all on all resources. **What are the security risks of AmazonDynamoDBFullAccesswithDataPipeline?** It allows iam:PassRole on all resources with no condition, lambda:*, datapipeline:* and elasticmapreduce:*, EC2 terminate actions, and S3 put and delete actions on all resources. The description says the policy is on a deprecation path. AWS managed policies do not grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonDynamoDBFullAccesswithDataPipeline (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDynamoDBFullAccesswithDataPipeline.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonDynamoDBReadOnlyAccess - Page: https://iampolicymap.com/policies/amazondynamodbreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess` - Kind: standard. Domain: databases. Default version: v15. Guide reviewed against: v15. - Tier: reader. Distinct granted actions: 71 control plane, 8 data plane, 7 unclassified. - AWS description: Provides read only access to Amazon DynamoDB via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazondynamodbreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon DynamoDB via the AWS Management Console. The Amazon DynamoDB Developer Guide says it grants read-only access to Amazon DynamoDB, with read-only access to DynamoDB Accelerator (DAX) and view access to related services. ### Practical scope The GeneralReadOnlyAccess statement applies to Resource "*" and allows dynamodb:BatchGetItem, dynamodb:GetItem, dynamodb:Query, dynamodb:Scan, dynamodb:PartiQLSelect, dynamodb:Describe* and dynamodb:List*, the DAX equivalents (dax:GetItem, dax:BatchGetItem, dax:Query, dax:Scan, dax:Describe*, dax:List*), and describe and list actions for Application Auto Scaling, CloudWatch, AWS Data Pipeline, Amazon EC2, IAM, AWS KMS, Amazon SNS, Lambda, AWS Resource Groups and Kinesis. A second statement allows cloudwatch:GetInsightRuleReport on DynamoDBContributorInsights rules. ### Use cases - Give users, groups or roles read-only access to DynamoDB, including viewing the Application Auto Scaling policies, CloudWatch alarms, KMS keys and Kinesis streams related to a table. ### Prerequisites None. ### Best practices - The best practice is to create custom IAM policies that grant least privilege to the users, roles or groups that require them. ### Security considerations - The policy reads table data, not only table metadata: it allows dynamodb:GetItem, dynamodb:BatchGetItem, dynamodb:Query, dynamodb:Scan and dynamodb:PartiQLSelect, and the matching DAX actions, on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon DynamoDB Developer Guide says you can attach it to your IAM identities. It fits where read-only access to DynamoDB is intended. ### FAQs **When should I attach AmazonDynamoDBReadOnlyAccess?** The Amazon DynamoDB Developer Guide says you can attach it to your IAM identities and that it grants read-only access to Amazon DynamoDB. Attach it where reading DynamoDB tables is the intended scope. For narrower access, AWS recommends custom policies that grant least privilege. **What does AmazonDynamoDBReadOnlyAccess grant?** It allows dynamodb:GetItem, dynamodb:BatchGetItem, dynamodb:Query, dynamodb:Scan, dynamodb:PartiQLSelect, dynamodb:Describe* and dynamodb:List*, the DAX equivalents, and describe and list actions for related services such as Application Auto Scaling, CloudWatch, AWS KMS and Kinesis, on all resources. **What are the security risks of AmazonDynamoDBReadOnlyAccess?** It reads item data from every table (dynamodb:Scan, dynamodb:Query) and from DAX clusters. AWS recommends custom IAM policies that grant least privilege, and updates to the policy affect every identity it is attached to. ### Sources - [AmazonDynamoDBReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDynamoDBReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon DynamoDB (Amazon DynamoDB Developer Guide)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/ddb-security-iam.awsmanpol.md), retrieved 2026-11-12 - [Using identity-based policies (IAM policies) for Amazon DynamoDB (Amazon DynamoDB Developer Guide)](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/using-identity-based-policies.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonEC2ContainerRegistryFullAccess - Page: https://iampolicymap.com/policies/amazonec2containerregistryfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess` - Kind: standard. Domain: containers. Default version: v3. Guide reviewed against: v3. - Tier: admin. Distinct granted actions: 67 control plane, 0 data plane, 3 unclassified. - AWS description: Provides administrative access to Amazon ECR resources - Actions: https://iampolicymap.com/policies/amazonec2containerregistryfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: ecr (36 of 36). ### Summary Provides administrative access to Amazon ECR resources. The Amazon ECR User Guide says it also grants access to the AWS services Amazon ECR is integrated with, for all Amazon ECR features available in the console. ### Practical scope The first statement allows ecr:* and cloudtrail:LookupEvents on Resource "*". The second allows iam:CreateServiceLinkedRole on Resource "*" only when iam:AWSServiceName is replication.ecr.amazonaws.com. ### Use cases - Give users, groups or roles administrative access to Amazon ECR repositories and images. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - ecr:* allows every Amazon ECR action on all resources, so it is not limited the way AmazonEC2ContainerRegistryPowerUser is, which the Amazon ECR User Guide says does not allow repository deletion or policy changes. - The policy also allows cloudtrail:LookupEvents on all resources and iam:CreateServiceLinkedRole for replication.ecr.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon ECR User Guide says you can attach it to your IAM identities. It fits where administrative access to Amazon ECR is intended. Where read and push access is enough, the guide describes AmazonEC2ContainerRegistryPowerUser. ### FAQs **When should I attach AmazonEC2ContainerRegistryFullAccess?** The Amazon ECR User Guide says you can attach it to your IAM identities, and that it grants administrative access to Amazon ECR resources for all Amazon ECR features available in the console. Attach it where that scope is intended. **What does AmazonEC2ContainerRegistryFullAccess grant?** It allows ecr:* and cloudtrail:LookupEvents on all resources, and iam:CreateServiceLinkedRole only for replication.ecr.amazonaws.com. **What are the security risks of AmazonEC2ContainerRegistryFullAccess?** ecr:* allows every Amazon ECR action on all resources, without the limits the guide describes for AmazonEC2ContainerRegistryPowerUser. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonEC2ContainerRegistryFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerRegistryFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonEC2ContainerRegistryPowerUser - Page: https://iampolicymap.com/policies/amazonec2containerregistrypoweruser/ - ARN: `arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser` - Kind: standard. Domain: containers. Default version: v3. Guide reviewed against: v3. - Tier: operator. Distinct granted actions: 16 control plane, 0 data plane, 0 unclassified. - AWS description: Provides full access to Amazon EC2 Container Registry repositories, but does not allow repository deletion or policy changes. - Actions: https://iampolicymap.com/policies/amazonec2containerregistrypoweruser/actions.json ### Tier reasons - Grants 4 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides full access to Amazon EC2 Container Registry repositories, but does not allow repository deletion or policy changes. The Amazon ECR User Guide says it allows users to read and write to repositories. ### Practical scope One statement on Resource "*" allows 16 actions: ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, ecr:GetRepositoryPolicy, ecr:DescribeRepositories, ecr:ListImages, ecr:DescribeImages, ecr:BatchGetImage, ecr:GetLifecyclePolicy, ecr:GetLifecyclePolicyPreview, ecr:ListTagsForResource, ecr:DescribeImageScanFindings, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload and ecr:PutImage. ### Use cases - Let users read and write to Amazon ECR repositories without being able to delete repositories or change their policy documents. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The four write actions are ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload and ecr:PutImage, and they apply to Resource "*", so they cover every repository in the account. - The action list has no action that creates or deletes repositories, deletes images or sets a repository policy, which matches the guide saying repository deletion and policy changes are not allowed. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon ECR User Guide says you can attach it to your IAM identities. It fits where reading and writing to repositories is intended without repository deletion or policy changes. ### FAQs **When should I attach AmazonEC2ContainerRegistryPowerUser?** The Amazon ECR User Guide says you can attach it to your IAM identities, and that it allows users to read and write to repositories but not delete repositories or change their policy documents. Attach it where that scope is intended. **What does AmazonEC2ContainerRegistryPowerUser grant?** It allows 16 Amazon ECR actions on all resources: twelve read actions, plus ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload and ecr:PutImage. **What are the security risks of AmazonEC2ContainerRegistryPowerUser?** The write actions apply to all repositories in the account. Repository deletion and policy changes are not in the action list. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonEC2ContainerRegistryPowerUser (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerRegistryPowerUser.md), retrieved 2026-11-13 - [AWS managed policies for Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonEC2ContainerRegistryReadOnly - Page: https://iampolicymap.com/policies/amazonec2containerregistryreadonly/ - ARN: `arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly` - Kind: standard. Domain: containers. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 12 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read-only access to Amazon EC2 Container Registry repositories. - Actions: https://iampolicymap.com/policies/amazonec2containerregistryreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Amazon EC2 Container Registry repositories. The Amazon ECR User Guide says it includes listing repositories and images and pulling images with the Docker CLI. ### Practical scope One statement on Resource "*" allows 12 actions: ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, ecr:GetRepositoryPolicy, ecr:DescribeRepositories, ecr:ListImages, ecr:DescribeImages, ecr:BatchGetImage, ecr:GetLifecyclePolicy, ecr:GetLifecyclePolicyPreview, ecr:ListTagsForResource and ecr:DescribeImageScanFindings. It has no upload, create, delete or policy-changing actions. ### Use cases - Let users or roles list Amazon ECR repositories and images and pull images, without changing anything. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources, so principals can pull images from every repository in the account. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon ECR User Guide says you can attach it to your IAM identities. It fits where read-only access to Amazon ECR is intended. ### FAQs **When should I attach AmazonEC2ContainerRegistryReadOnly?** The Amazon ECR User Guide says you can attach it to your IAM identities, and that it grants read-only permissions to Amazon ECR, including listing repositories and images and pulling images with the Docker CLI. Attach it where that scope is intended. **What does AmazonEC2ContainerRegistryReadOnly grant?** It allows 12 read and pull actions on all resources, including ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, ecr:DescribeRepositories and ecr:ListImages. It has no upload, create, delete or policy-changing actions. **What are the security risks of AmazonEC2ContainerRegistryReadOnly?** The policy grants no write actions, but it applies to all resources and includes pulling images from every repository. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonEC2ContainerRegistryReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerRegistryReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonEC2FullAccess - Page: https://iampolicymap.com/policies/amazonec2fullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonEC2FullAccess` - Kind: standard. Domain: compute. Default version: v5. Guide reviewed against: v5. - Tier: admin. Distinct granted actions: 1140 control plane, 5 data plane, 81 unclassified. - AWS description: Provides full access to Amazon EC2 via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonec2fullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: autoscaling (43 of 43), cloudwatch (89 of 89), ec2 (544 of 544), elasticloadbalancing (51 of 51). ### Summary Provides full access to Amazon EC2 via the AWS Management Console. The policy allows ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on all resources, and iam:CreateServiceLinkedRole for a fixed list of services. ### Practical scope Four statements allow every action in the ec2, elasticloadbalancing, cloudwatch and autoscaling namespaces on Resource "*". A fifth allows iam:CreateServiceLinkedRole on all resources, with a StringEquals condition on iam:AWSServiceName limited to autoscaling.amazonaws.com, ec2scheduled.amazonaws.com, elasticloadbalancing.amazonaws.com, spot.amazonaws.com, spotfleet.amazonaws.com and transitgateway.amazonaws.com. ### Use cases - Give users, groups or roles full access to Amazon EC2, including the Elastic Load Balancing, CloudWatch and Auto Scaling actions the policy includes. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The wildcards ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on Resource "*" allow every action in those services on all resources, not only reads. - You can't change the permissions in AWS managed policies. Services occasionally add permissions to an AWS managed policy to support new features, and this type of update affects all identities where the policy is attached. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon EC2 is intended. For narrower access, the IAM User Guide suggests writing a customer managed policy with only the permissions your team needs. ### FAQs **When should I attach AmazonEC2FullAccess?** The Amazon EC2 User Guide says you can attach it to your IAM identities and that it grants permissions that allow full access to Amazon EC2. Attach it where that is the intended scope. For narrower access, write a customer managed policy with only the permissions your team needs. **What does AmazonEC2FullAccess grant?** It allows ec2:*, elasticloadbalancing:*, cloudwatch:* and autoscaling:* on all resources. It also allows iam:CreateServiceLinkedRole, limited by an iam:AWSServiceName condition to autoscaling.amazonaws.com, ec2scheduled.amazonaws.com, elasticloadbalancing.amazonaws.com, spot.amazonaws.com, spotfleet.amazonaws.com and transitgateway.amazonaws.com. **What are the security risks of AmazonEC2FullAccess?** It allows every action in the EC2, Elastic Load Balancing, CloudWatch and Auto Scaling namespaces on all resources, not only reads. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. Services add permissions to AWS managed policies over time, and each update affects all identities the policy is attached to. ### Sources - [AmazonEC2FullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2FullAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon EC2 (Amazon EC2 User Guide)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonEC2ReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonec2readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess` - Kind: standard. Domain: compute. Default version: v5. Guide reviewed against: v5. - Tier: reader. Distinct granted actions: 243 control plane, 2 data plane, 4 unclassified. - AWS description: Provides read only access to Amazon EC2 via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonec2readonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon EC2 via the AWS Management Console. The policy allows ec2:Describe* and ec2:GetSecurityGroupsForVpc, plus read actions for Elastic Load Balancing, CloudWatch and Auto Scaling, on all resources. ### Practical scope Every statement applies to Resource "*". The actions are ec2:Describe*, ec2:GetSecurityGroupsForVpc, elasticloadbalancing:Describe*, cloudwatch:ListMetrics, cloudwatch:GetMetricStatistics, cloudwatch:Describe* and autoscaling:Describe*. The policy contains no create, modify, delete or run actions. ### Use cases - Give users, groups or roles read-only access to Amazon EC2, including Describe access to Elastic Load Balancing and Auto Scaling and read access to CloudWatch metrics. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy reaches beyond EC2: it also allows Describe actions for Elastic Load Balancing, CloudWatch and Auto Scaling, and cloudwatch:GetMetricStatistics, on all resources. - You can't change the permissions in AWS managed policies. Services occasionally add permissions to an AWS managed policy to support new features, and this type of update affects all identities where the policy is attached. ### Assignment guidance You can attach this policy to your IAM identities (users, groups and roles). The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon EC2 is intended. For narrower access, the IAM User Guide suggests writing a customer managed policy with only the permissions your team needs. ### FAQs **When should I attach AmazonEC2ReadOnlyAccess?** The Amazon EC2 User Guide says you can attach it to your IAM identities and that it grants permissions that allow read-only access to Amazon EC2. Attach it where viewing EC2 resources is the intended scope. For narrower access, write a customer managed policy with only the permissions your team needs. **What does AmazonEC2ReadOnlyAccess grant?** It allows ec2:Describe*, ec2:GetSecurityGroupsForVpc, elasticloadbalancing:Describe*, cloudwatch:ListMetrics, cloudwatch:GetMetricStatistics, cloudwatch:Describe* and autoscaling:Describe* on all resources. It contains no create, modify, delete or run actions. **What are the security risks of AmazonEC2ReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and covers Elastic Load Balancing, CloudWatch and Auto Scaling as well as EC2. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. Services add permissions to AWS managed policies over time, and each update affects all identities the policy is attached to. ### Sources - [AmazonEC2ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon EC2 (Amazon EC2 User Guide)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonECS_FullAccess - Page: https://iampolicymap.com/policies/amazonecs_fullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonECS_FullAccess` - Kind: standard. Domain: compute. Default version: v22. Guide reviewed against: v22. - Tier: admin. Distinct granted actions: 440 control plane, 1 data plane, 7 unclassified. - AWS description: Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups, and CloudFormation stacks. - Actions: https://iampolicymap.com/policies/amazonecs_fullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: ecs (55 of 55). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides administrative access to Amazon ECS resources and enables ECS features through access to other AWS service resources, including VPCs, Auto Scaling groups and CloudFormation stacks. The Amazon ECS Developer Guide says it allows access to all Amazon ECS features available in the AWS Management Console. ### Practical scope The ECSIntegrationsManagementPolicy statement allows ecs:* and a long list of actions on Resource "*" for services ECS integrates with: Application Auto Scaling, App Mesh, Auto Scaling, CloudFormation (cloudformation:CreateStack, cloudformation:UpdateStack, cloudformation:DeleteStack), CloudWatch alarms, CodeDeploy, EC2 (including ec2:RunInstances, ec2:CreateVpc, ec2:DeleteVpc and ec2:CreateSecurityGroup), Elastic Load Balancing, EventBridge (events:PutRule, events:PutTargets), Route 53 (route53:CreateHostedZone, route53:DeleteHostedZone), AWS Cloud Map (servicediscovery), CloudWatch Logs, and list or describe actions for IAM, Lambda, SNS, EFS and FSx. Other statements allow SSM parameter reads under parameter/aws/service/ecs*, deleting some EC2 network resources tagged with a CloudFormation stack name matching EC2ContainerService-*, service-linked role creation for five named services, tagging, and iam:PassRole in four statements. ### Use cases - Give users, groups or roles administrative access to Amazon ECS, including the integrated services needed to use all Amazon ECS features in the console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - ecs:* plus ec2:RunInstances, ec2:CreateVpc, ec2:DeleteVpc, cloudformation:CreateStack, cloudformation:DeleteStack and route53:DeleteHostedZone apply to Resource "*". The policy reaches well beyond Amazon ECS. - iam:PassRole is allowed on Resource "*" when iam:PassedToService is ecs-tasks.amazonaws.com, so any role in the account can be passed to ECS tasks. The IAM User Guide warns that a user should not be able to pass a role that has more permissions than you want the user to have. - The policy also allows iam:CreateServiceLinkedRole for ecs.amazonaws.com, autoscaling.amazonaws.com, ecs.application-autoscaling.amazonaws.com, spot.amazonaws.com and spotfleet.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon ECS Developer Guide says you can attach it to your IAM identities. It fits where administrative access to Amazon ECS and its integrations is intended. ### FAQs **When should I attach AmazonECS_FullAccess?** The Amazon ECS Developer Guide says you can attach it to your IAM identities, and that it grants administrative access to Amazon ECS and access to the services Amazon ECS is integrated with, for all Amazon ECS features available in the console. Attach it where that scope is intended. **What does AmazonECS_FullAccess grant?** It allows ecs:* and a long list of actions for Application Auto Scaling, App Mesh, Auto Scaling, CloudFormation, CloudWatch, CodeDeploy, EC2, Elastic Load Balancing, EventBridge, Route 53, AWS Cloud Map and CloudWatch Logs on all resources, plus scoped SSM reads, tagged network resource deletion, service-linked role creation and iam:PassRole. **What are the security risks of AmazonECS_FullAccess?** It can launch EC2 instances, create and delete VPCs and CloudFormation stacks, and pass any role to ECS tasks, all on Resource "*" or with a broad condition. The IAM User Guide warns against letting a user pass a role that has more permissions than you want the user to have. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonECS_FullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonECS_FullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticContainerRegistryPublicReadOnly - Page: https://iampolicymap.com/policies/amazonelasticcontainerregistrypublicreadonly/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticContainerRegistryPublicReadOnly` - Kind: standard. Domain: containers. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 10 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read-only access to Amazon ECR Public repositories. - Actions: https://iampolicymap.com/policies/amazonelasticcontainerregistrypublicreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Amazon ECR Public repositories. The Amazon ECR Public User Guide says to add it to entities so they can still use the Amazon ECR console. ### Practical scope One statement allows 10 actions on Resource "*": ecr-public:GetAuthorizationToken, sts:GetServiceBearerToken, ecr-public:BatchCheckLayerAvailability, ecr-public:GetRepositoryPolicy, ecr-public:DescribeRepositories, ecr-public:DescribeRegistries, ecr-public:DescribeImages, ecr-public:DescribeImageTags, ecr-public:GetRepositoryCatalogData and ecr-public:GetRegistryCatalogData. ### Use cases - Give users or roles read-only access to Amazon ECR Public repositories, including the console minimum for listing and viewing ECR Public resources. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It includes ecr-public:GetAuthorizationToken and sts:GetServiceBearerToken, which are not describe or list actions, so it is more than metadata reads. - ecr-public:GetRepositoryPolicy lets principals read repository policies on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon ECR Public User Guide says to add it to entities so they can still use the Amazon ECR console when you use more restrictive policies. ### FAQs **When should I attach AmazonElasticContainerRegistryPublicReadOnly?** The reference page says you can attach AmazonElasticContainerRegistryPublicReadOnly to your users, groups and roles, and describes it as: provides read-only access to Amazon ECR Public repositories. Attach it where viewing ECR Public repositories is the intended scope. **What does AmazonElasticContainerRegistryPublicReadOnly grant?** It allows ten actions on all resources: ecr-public describe, catalog data and repository policy reads, ecr-public:BatchCheckLayerAvailability, ecr-public:GetAuthorizationToken and sts:GetServiceBearerToken. **What are the security risks of AmazonElasticContainerRegistryPublicReadOnly?** It is read only by name, but it includes GetAuthorizationToken and sts:GetServiceBearerToken and applies to all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonElasticContainerRegistryPublicReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticContainerRegistryPublicReadOnly.md), retrieved 2026-11-13 - [Amazon ECR public identity-based policy examples](https://docs.aws.amazon.com/AmazonECR/latest/public/security_iam_id-based-policy-examples.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticFileSystemClientFullAccess - Page: https://iampolicymap.com/policies/amazonelasticfilesystemclientfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticFileSystemClientFullAccess` - Kind: standard. Domain: storage. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 4 control plane, 0 data plane, 3 unclassified. - AWS description: Provides root client access to an Amazon EFS file system - Actions: https://iampolicymap.com/policies/amazonelasticfilesystemclientfullaccess/actions.json ### Tier reasons - Grants 2 write, tagging or permissions-management actions, short of full control of any service. - 2 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides root client access to an Amazon EFS file system. The Amazon EFS User Guide describes it as granting read and write client access, allowing NFS clients to mount, read and write to EFS file systems. ### Practical scope One statement on Resource "*" allows elasticfilesystem:ClientMount, elasticfilesystem:ClientRootAccess, elasticfilesystem:ClientWrite and elasticfilesystem:DescribeMountTargets. ### Use cases - Let an NFS client mount an Amazon EFS file system and read and write to it. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The action list includes elasticfilesystem:ClientRootAccess and elasticfilesystem:ClientWrite on Resource "*", so the access applies to every EFS file system. The reference description says root client access, while the Amazon EFS User Guide describes read and write client access. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon EFS User Guide says you can attach it to an IAM entity. It fits where read and write client access from NFS clients is intended. ### FAQs **When should I attach AmazonElasticFileSystemClientFullAccess?** The Amazon EFS User Guide says you can attach it to an IAM entity, and that it allows NFS clients to mount, read and write to EFS file systems. Attach it where that client access is intended. **What does AmazonElasticFileSystemClientFullAccess grant?** It allows elasticfilesystem:ClientMount, elasticfilesystem:ClientRootAccess, elasticfilesystem:ClientWrite and elasticfilesystem:DescribeMountTargets on all resources. **What are the security risks of AmazonElasticFileSystemClientFullAccess?** It includes elasticfilesystem:ClientRootAccess and elasticfilesystem:ClientWrite on all resources, and the reference description calls it root client access. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonElasticFileSystemClientFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticFileSystemClientFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticFileSystemClientReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonelasticfilesystemclientreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticFileSystemClientReadOnlyAccess` - Kind: standard. Domain: storage. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 2 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read only client access to an Amazon EFS file system - Actions: https://iampolicymap.com/policies/amazonelasticfilesystemclientreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only client access to an Amazon EFS file system. ### Practical scope One statement on Resource "*" allows elasticfilesystem:ClientMount and elasticfilesystem:DescribeMountTargets. It has no write or root client actions. ### Use cases - Give an IAM identity read only client access to an Amazon EFS file system. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to Resource "*", so the client access covers every EFS file system. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read only client access to Amazon EFS is intended. ### FAQs **When should I attach AmazonElasticFileSystemClientReadOnlyAccess?** The reference page says you can attach it to your users, groups and roles, and the description says it provides read only client access to an Amazon EFS file system. Attach it where that scope is intended. **What does AmazonElasticFileSystemClientReadOnlyAccess grant?** It allows elasticfilesystem:ClientMount and elasticfilesystem:DescribeMountTargets on all resources. It has no write or root client actions. **What are the security risks of AmazonElasticFileSystemClientReadOnlyAccess?** The policy grants no write actions, but it applies to all resources, so the client access covers every EFS file system. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonElasticFileSystemClientReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticFileSystemClientReadOnlyAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticFileSystemFullAccess - Page: https://iampolicymap.com/policies/amazonelasticfilesystemfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticFileSystemFullAccess` - Kind: standard. Domain: storage. Default version: v10. Guide reviewed against: v10. - Tier: admin. Distinct granted actions: 50 control plane, 1 data plane, 4 unclassified. - AWS description: Provides full access to Amazon EFS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonelasticfilesystemfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: elasticfilesystem (19 of 21). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 3 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon EFS via the AWS Management Console. The Amazon EFS User Guide says it grants administrative permissions for full access to Amazon EFS and access to related AWS services. ### Practical scope The ElasticFileSystemFullAccess statement on Resource "*" allows elasticfilesystem actions to create, update and delete file systems, mount targets, access points, tags and replication configurations, to put or delete file system policies, to put backup policies, lifecycle configurations and account preferences, and elasticfilesystem:Backup, elasticfilesystem:Restore, elasticfilesystem:ReplicationRead and elasticfilesystem:ReplicationWrite. It also allows CloudWatch metric and alarm reads, EC2 network interface and describe actions (including ec2:CreateNetworkInterface, ec2:DeleteNetworkInterface and ec2:ModifyNetworkInterfaceAttribute), kms:DescribeKey and kms:ListAliases. CreateServiceLinkedRoleForEFS allows iam:CreateServiceLinkedRole for elasticfilesystem.amazonaws.com, and IAMPassRoleAccessForEFS allows iam:PassRole on arn:aws:iam::*:role/* when iam:PassedToService matches elasticfilesystem.amazonaws.com. ### Use cases - Give users, groups or roles full access to Amazon EFS through the console, including the EC2 network and monitoring access the console needs. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows elasticfilesystem:DeleteFileSystem, elasticfilesystem:DeleteMountTarget, elasticfilesystem:PutFileSystemPolicy and elasticfilesystem:DeleteFileSystemPolicy on Resource "*", so it can change or remove any EFS file system in the account. - iam:PassRole is allowed on any role (arn:aws:iam::*:role/*) when it is passed to elasticfilesystem.amazonaws.com. The IAM User Guide warns that a user should not be able to pass a role that has more permissions than you want the user to have. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon EFS User Guide says you can attach it to your IAM identities. It fits where full access to Amazon EFS is intended. ### FAQs **When should I attach AmazonElasticFileSystemFullAccess?** The Amazon EFS User Guide says you can attach it to your IAM identities, and that it grants administrative permissions with full access to Amazon EFS and related AWS services through the console. Attach it where that scope is intended. **What does AmazonElasticFileSystemFullAccess grant?** It allows Amazon EFS management actions on all resources, including AWS Backup backup and restore, CloudWatch reads, EC2 network interface actions, kms:DescribeKey and kms:ListAliases, service-linked role creation for Amazon EFS, and iam:PassRole to elasticfilesystem.amazonaws.com. **What are the security risks of AmazonElasticFileSystemFullAccess?** It allows deleting file systems and mount targets and changing file system policies on all resources, and passing any role to Amazon EFS. The IAM User Guide warns against letting a user pass a role that has more permissions than you want the user to have. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonElasticFileSystemFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticFileSystemFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticFileSystemReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonelasticfilesystemreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticFileSystemReadOnlyAccess` - Kind: standard. Domain: storage. Default version: v9. Guide reviewed against: v9. - Tier: reader. Distinct granted actions: 21 control plane, 1 data plane, 1 unclassified. - AWS description: Provides read only access to Amazon EFS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonelasticfilesystemreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon EFS via the AWS Management Console. The Amazon EFS User Guide says principals can describe EFS attributes and view related CloudWatch, EC2 and AWS KMS information in the console. ### Practical scope One statement on Resource "*" allows elasticfilesystem Describe actions (DescribeAccountPreferences, DescribeBackupPolicy, DescribeFileSystems, DescribeFileSystemPolicy, DescribeLifecycleConfiguration, DescribeMountTargets, DescribeMountTargetSecurityGroups, DescribeTags, DescribeAccessPoints, DescribeReplicationConfigurations), elasticfilesystem:ListTagsForResource and elasticfilesystem:ReplicationRead, plus cloudwatch:DescribeAlarmsForMetric, cloudwatch:GetMetricData, EC2 describe actions for availability zones, network interfaces, security groups, subnets and VPCs, and kms:ListAliases. ### Use cases - Let users view Amazon EFS file systems, mount targets and access points, and the related metrics and network details, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources and also reads CloudWatch metrics and alarms, EC2 network details and AWS KMS key aliases. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon EFS User Guide says you can attach it to your IAM identities. It fits where read only access to Amazon EFS in the console is intended. ### FAQs **When should I attach AmazonElasticFileSystemReadOnlyAccess?** The Amazon EFS User Guide says you can attach it to your IAM identities, and that it grants read only access to Amazon EFS through the console. Attach it where viewing EFS resources is the intended scope. **What does AmazonElasticFileSystemReadOnlyAccess grant?** It allows elasticfilesystem Describe actions, elasticfilesystem:ListTagsForResource and elasticfilesystem:ReplicationRead, CloudWatch metric and alarm reads, EC2 describe actions and kms:ListAliases on all resources. **What are the security risks of AmazonElasticFileSystemReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and covers CloudWatch, EC2 and AWS KMS reads as well as Amazon EFS. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonElasticFileSystemReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticFileSystemReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EFS](https://docs.aws.amazon.com/efs/latest/ug/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonElasticMapReduceFullAccess - Page: https://iampolicymap.com/policies/amazonelasticmapreducefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonElasticMapReduceFullAccess` - Kind: standard. Domain: privileged. Default version: v8. Guide reviewed against: v8. - Tier: admin; High privilege. Distinct granted actions: 460 control plane, 30 data plane, 116 unclassified. - AWS description: This policy is on a deprecation path. See documentation for guidance: https://docs.aws.amazon.com/emr/latest/ManagementGuide/emr-managed-iam-policies.html. Provides full access to Amazon Elastic MapReduce and underlying services that it req… - Actions: https://iampolicymap.com/policies/amazonelasticmapreducefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: cloudwatch (89 of 89), elasticmapreduce (54 of 54), s3 (84 of 84), sdb (7 of 7). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole on all resources without conditions. - 18 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon Elastic MapReduce and the underlying services it requires, such as EC2 and S3. AWS says this policy is on a deprecation path and points to the Amazon EMR documentation for guidance. ### Practical scope The first statement allows, on Resource "*" with no Condition, elasticmapreduce:*, s3:*, cloudwatch:*, sdb:*, kms:List*, iam:PassRole and read actions iam:GetPolicy, iam:GetPolicyVersion and iam:ListRoles, two CloudFormation actions, and EC2 actions including ec2:RunInstances, ec2:TerminateInstances, ec2:CreateSecurityGroup, ec2:DeleteSecurityGroup, ec2:AuthorizeSecurityGroupIngress, ec2:ModifyInstanceAttribute and ec2:CreateVpcEndpoint. iam:CreateServiceLinkedRole is allowed on all resources when the service name matches elasticmapreduce.amazonaws.com or elasticmapreduce.amazonaws.com.cn. cloudformation:TagResource and cloudformation:UntagResource are allowed when cloudformation:CreateAction is CreateStack. ### Use cases - Run and manage Amazon EMR, with the EC2, S3 and related actions it needs. AWS says the policy is on a deprecation path, so check the EMR documentation it links to before using it for new work. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - s3:*, elasticmapreduce:*, cloudwatch:* and sdb:* allow every action in those services on all resources. - iam:PassRole is allowed on all resources with no iam:PassedToService condition. The IAM User Guide says a user needs permission to pass a role to an AWS service before the service can be configured with it. - The EC2 actions include ec2:RunInstances, ec2:TerminateInstances, security group changes and ec2:ModifyInstanceAttribute on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS marks this policy as being on a deprecation path, so check the guidance it links to before using it in a new permission set. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonElasticMapReduceFullAccess?** AWS says this policy is on a deprecation path and links to the Amazon EMR documentation for guidance, so review that page before attaching it. The policy is meant for users, groups or roles that need full EMR access together with the EC2 and S3 actions it includes. **What does AmazonElasticMapReduceFullAccess grant?** It allows elasticmapreduce:*, s3:*, cloudwatch:* and sdb:* on all resources, EC2 actions to launch and manage instances and security groups, iam:PassRole, read actions for IAM policies and roles, kms:List*, and creating the EMR service-linked role. **What are the security risks of AmazonElasticMapReduceFullAccess?** It combines wildcard access to EMR and S3 with EC2 instance control and iam:PassRole on all resources without a service condition. AWS says the policy is on a deprecation path. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonElasticMapReduceFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonElasticMapReduceFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonEventBridgeFullAccess - Page: https://iampolicymap.com/policies/amazoneventbridgefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonEventBridgeFullAccess` - Kind: standard. Domain: application-integration. Default version: v7. Guide reviewed against: v7. - Tier: admin. Distinct granted actions: 132 control plane, 3 data plane, 4 unclassified. - AWS description: Provides full access to Amazon EventBridge. - Actions: https://iampolicymap.com/policies/amazoneventbridgefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: events (45 of 45), pipes (5 of 5), scheduler (5 of 5), schemas (15 of 15). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Amazon EventBridge. The Amazon EventBridge User Guide says it grants permissions to use all EventBridge actions, including EventBridge Pipes, Schemas and Scheduler. ### Practical scope The EventBridgeActions statement allows events:*, schemas:*, scheduler:* and pipes:* on Resource "*". Two statements allow iam:CreateServiceLinkedRole for the API destinations and Schemas service-linked roles. SecretsManagerAccessForApiDestinations allows secretsmanager:CreateSecret, UpdateSecret, DeleteSecret, GetSecretValue and PutSecretValue on secrets named events!*. Three statements allow iam:PassRole on arn:aws:iam::*:role/* when iam:PassedToService is events.amazonaws.com, scheduler.amazonaws.com or pipes.amazonaws.com. ### Use cases - Give users, groups or roles full access to Amazon EventBridge, including EventBridge Pipes, EventBridge Schemas and EventBridge Scheduler. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - events:*, schemas:*, scheduler:* and pipes:* allow every action in those services on all resources. - iam:PassRole is allowed on any role (arn:aws:iam::*:role/*) when it is passed to EventBridge, Scheduler or Pipes. The IAM User Guide warns that a user should not be able to pass a role that has more permissions than you want the user to have. - The policy allows secretsmanager:GetSecretValue on secrets named events!*. The Amazon EventBridge User Guide says EventBridge requires the Secrets Manager permissions to manage secrets when you provide credentials through a connection for API destinations. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon EventBridge is intended. ### FAQs **When should I attach AmazonEventBridgeFullAccess?** The Amazon EventBridge User Guide says it grants permissions to use all EventBridge actions, and the reference page says you can attach it to your users, groups and roles. Attach it where that scope is intended. **What does AmazonEventBridgeFullAccess grant?** It allows events:*, schemas:*, scheduler:* and pipes:* on all resources, service-linked role creation for API destinations and Schemas, Secrets Manager actions on secrets named events!*, and iam:PassRole to EventBridge, Scheduler and Pipes. **What are the security risks of AmazonEventBridgeFullAccess?** It allows every action in four services on all resources and iam:PassRole on any role to EventBridge, Scheduler and Pipes. The IAM User Guide warns against letting a user pass a role that has more permissions than you want the user to have. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonEventBridgeFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEventBridgeFullAccess.md), retrieved 2026-11-13 - [Identity-based policies for Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-identity-based.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonEventBridgeReadOnlyAccess - Page: https://iampolicymap.com/policies/amazoneventbridgereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonEventBridgeReadOnlyAccess` - Kind: standard. Domain: application-integration. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 46 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read only access to Amazon EventBridge. - Actions: https://iampolicymap.com/policies/amazoneventbridgereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon EventBridge. The Amazon EventBridge User Guide says it grants permissions to use all read EventBridge actions, including EventBridge Pipes, Schemas and Scheduler. ### Practical scope One statement on Resource "*" allows events Describe and List actions (for rules, event buses, event sources, archives, replays, connections, API destinations, endpoints and subscribers), events:TestEventPattern, events:GetResourcePolicy, events:ListResourcePolicies and events:ListTagsForResource; schemas read actions including schemas:ExportSchema, schemas:GetCodeBindingSource, schemas:GetDiscoveredSchema and schemas:SearchSchemas; scheduler:GetSchedule, scheduler:GetScheduleGroup and list actions; and pipes:DescribePipe, pipes:ListPipes and pipes:ListTagsForResource. ### Use cases - View EventBridge resources and their configuration without changing them, for example to audit access or troubleshoot event delivery. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources and also reads event bus resource policies and the tags on EventBridge resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon EventBridge User Guide says you can attach it to your users, groups and roles. It fits where viewing EventBridge resources without changing them is intended. ### FAQs **When should I attach AmazonEventBridgeReadOnlyAccess?** The Amazon EventBridge User Guide says you can attach it to your users, groups and roles, and to use it when you need to view EventBridge resources and their configuration without changing them, for example to audit access or troubleshoot event delivery. **What does AmazonEventBridgeReadOnlyAccess grant?** It allows read actions for events, schemas, scheduler and pipes on all resources, including events:GetResourcePolicy, events:ListResourcePolicies, events:ListTagsForResource and events:TestEventPattern. It has no create, update or delete actions. **What are the security risks of AmazonEventBridgeReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and also reads event bus resource policies and resource tags. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonEventBridgeReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEventBridgeReadOnlyAccess.md), retrieved 2026-11-13 - [Identity-based policies for Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-identity-based.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonFSxConsoleFullAccess - Page: https://iampolicymap.com/policies/amazonfsxconsolefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonFSxConsoleFullAccess` - Kind: standard. Domain: storage. Default version: v20. Guide reviewed against: v20. - Tier: admin. Distinct granted actions: 69 control plane, 2 data plane, 7 unclassified. - AWS description: Provides full access to Amazon FSx and access to related AWS services via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonfsxconsolefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: fsx (36 of 41). - 3 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon FSx and access to related AWS services via the AWS Management Console. The Amazon FSx for Windows File Server User Guide says it grants administrative permissions for full access to Amazon FSx and related services through the console. ### Practical scope Six statements. The first allows 15 list and describe actions on Resource "*" for related services (CloudWatch, Directory Service, EC2, Firehose, KMS, CloudWatch Logs, Amazon S3 and Secrets Manager), including s3:ListBucket and secretsmanager:ListSecrets. FullAccessToFSx allows 51 fsx actions on Resource "*", covering create, update, delete, describe, tag, backup and S3 access point actions. Two statements allow iam:CreateServiceLinkedRole only for fsx.amazonaws.com and s3.data-source.lustre.fsx.amazonaws.com. CreateTags allows ec2:CreateTags on route tables only for requests tagged AmazonFSx=ManagedByAmazonFSx and called via fsx.amazonaws.com. ManageCrossAccountDataReplication allows fsx:PutResourcePolicy, fsx:GetResourcePolicy and fsx:DeleteResourcePolicy only when called via ram.amazonaws.com. ### Use cases - Let administrators create and manage Amazon FSx file systems, volumes, backups and related resources through the AWS Management Console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - FullAccessToFSx lets a principal create and delete file systems, volumes, backups and snapshots (for example fsx:DeleteFileSystem and fsx:DeleteBackup) on all resources. - It includes s3:ListBucket on Resource "*", which the Amazon FSx guide describes as listing the objects in an Amazon S3 bucket, and secretsmanager:ListSecrets on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon FSx for Windows File Server User Guide says you can attach it to your IAM identities. It fits where full management of Amazon FSx through the console is intended. ### FAQs **When should I attach AmazonFSxConsoleFullAccess?** The Amazon FSx for Windows File Server User Guide says you can attach AmazonFSxConsoleFullAccess to your IAM identities, and that it grants administrative permissions for full access to Amazon FSx and related services through the console. Attach it for FSx administrators, and consider AmazonFSxConsoleReadOnlyAccess where viewing is enough. **What does AmazonFSxConsoleFullAccess grant?** It allows 51 fsx actions on all resources (create, update, delete, describe, tag, backup and S3 access point actions), 15 list and describe actions on related services, creating the Amazon FSx service-linked roles, and tagging route tables under a tag condition. **What are the security risks of AmazonFSxConsoleFullAccess?** It can create and delete file systems, volumes, backups and snapshots, and it lists S3 bucket contents and Secrets Manager secrets on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonFSxConsoleFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonFSxConsoleFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon FSx for Windows File Server (Amazon FSx for Windows File Server User Guide)](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonFSxConsoleReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonfsxconsolereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonFSxConsoleReadOnlyAccess` - Kind: standard. Domain: storage. Default version: v8. Guide reviewed against: v8. - Tier: reader. Distinct granted actions: 24 control plane, 1 data plane, 1 unclassified. - AWS description: Provides read only access to Amazon FSx and access to related AWS services via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonfsxconsolereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon FSx and access to related AWS services via the AWS Management Console. The Amazon FSx for Windows File Server User Guide says it grants read-only permissions so that users can view information about these services in the console. ### Practical scope One statement (FSxReadOnlyPermissions) allows 14 actions on Resource "*": fsx:Describe* and fsx:ListTagsForResource, plus read actions for related services (cloudwatch:DescribeAlarms, cloudwatch:GetMetricData, ds:DescribeDirectories, six ec2 actions, firehose:ListDeliveryStreams, kms:DescribeKey and logs:DescribeLogGroups). It has no create, update or delete actions. ### Use cases - Let users view Amazon FSx file systems and the related network, monitoring, directory and logging details in the AWS Management Console, without changing anything. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources, so principals can describe every Amazon FSx resource in the account along with related VPC, security group and CloudWatch alarm details. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon FSx for Windows File Server User Guide says you can attach it to your IAM identities. It fits where read-only access to Amazon FSx in the console is intended. ### FAQs **When should I attach AmazonFSxConsoleReadOnlyAccess?** The Amazon FSx for Windows File Server User Guide says you can attach AmazonFSxConsoleReadOnlyAccess to your IAM identities, and that it grants read-only permissions so that users can view information about Amazon FSx and related services in the console. Attach it where viewing is the intended scope. **What does AmazonFSxConsoleReadOnlyAccess grant?** It allows 14 read actions on all resources: fsx:Describe* and fsx:ListTagsForResource, plus describe and list actions for CloudWatch, Directory Service, EC2, Firehose, KMS and CloudWatch Logs. It has no create, update or delete actions. **What are the security risks of AmazonFSxConsoleReadOnlyAccess?** It grants no write actions, but it applies to all resources and exposes network and monitoring details around file systems. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonFSxConsoleReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonFSxConsoleReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon FSx for Windows File Server (Amazon FSx for Windows File Server User Guide)](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonFSxFullAccess - Page: https://iampolicymap.com/policies/amazonfsxfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonFSxFullAccess` - Kind: standard. Domain: storage. Default version: v13. Guide reviewed against: v13. - Tier: admin. Distinct granted actions: 65 control plane, 1 data plane, 8 unclassified. - AWS description: Provides full access to Amazon FSx and access to related AWS services. - Actions: https://iampolicymap.com/policies/amazonfsxfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: fsx (36 of 41). - 3 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon FSx and access to related AWS services. The Amazon FSx for Windows File Server User Guide says Amazon FSx also attaches this policy to a service role that allows Amazon FSx to perform actions on your behalf. ### Practical scope Nine statements. FullAccessToFSx allows 51 fsx actions on Resource "*", covering create, update, delete, describe, tag, backup and S3 access point actions. ViewAWSDSDirectories allows ds:DescribeDirectories. Two statements allow iam:CreateServiceLinkedRole only for fsx.amazonaws.com and s3.data-source.lustre.fsx.amazonaws.com. CreateLogsForFSxWindowsAuditLogs allows logs:CreateLogGroup, logs:CreateLogStream and logs:PutLogEvents on log groups under /aws/fsx/. WriteToAmazonKinesisDataFirehose allows firehose:PutRecord on delivery streams named aws-fsx-*. CreateTags allows ec2:CreateTags on route tables only for requests tagged AmazonFSx=ManagedByAmazonFSx and called via fsx.amazonaws.com. DescribeEC2VpcResources allows five ec2 actions via fsx.amazonaws.com. ManageCrossAccountDataReplication allows fsx:PutResourcePolicy, fsx:GetResourcePolicy and fsx:DeleteResourcePolicy only when called via ram.amazonaws.com. ### Use cases - Let administrators create and manage Amazon FSx file systems, volumes and backups, including sending FSx for Windows File Server audit access logs to CloudWatch Logs or Amazon Data Firehose. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - FullAccessToFSx lets a principal create and delete file systems, volumes, backups and snapshots (for example fsx:DeleteFileSystem and fsx:DeleteBackup) on all resources. - Amazon FSx also attaches this policy to a service role, so changes to the policy affect that role as well as the identities you attach it to. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon FSx for Windows File Server User Guide says you can attach it to your IAM entities. It also says Amazon FSx attaches the policy to a service role that lets Amazon FSx act on your behalf, so the policy is not only for human identities. It fits where full management of Amazon FSx is intended. ### FAQs **When should I attach AmazonFSxFullAccess?** The Amazon FSx for Windows File Server User Guide says you can attach AmazonFSxFullAccess to your IAM entities and that it provides full access to Amazon FSx and access to related AWS services. Attach it for FSx administrators, and consider AmazonFSxReadOnlyAccess where viewing is enough. **What does AmazonFSxFullAccess grant?** It allows 51 fsx actions on all resources, describing directories, creating the Amazon FSx service-linked roles, writing audit logs to log groups under /aws/fsx/ and records to delivery streams named aws-fsx-*, and tagging route tables under a tag condition. **What are the security risks of AmazonFSxFullAccess?** It can create and delete file systems, volumes, backups and snapshots on all resources. Amazon FSx also attaches the policy to a service role. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonFSxFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonFSxFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon FSx for Windows File Server (Amazon FSx for Windows File Server User Guide)](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonFSxReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonfsxreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonFSxReadOnlyAccess` - Kind: standard. Domain: storage. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 13 control plane, 0 data plane, 1 unclassified. - AWS description: Provides read only access to Amazon FSx. - Actions: https://iampolicymap.com/policies/amazonfsxreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon FSx. ### Practical scope One statement allows fsx:Describe* and fsx:ListTagsForResource on Resource "*". It has no create, update, delete or tagging actions, and no actions for other services. ### Use cases - Let users or roles view Amazon FSx file systems and their tags without changing anything. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources, so principals can describe every Amazon FSx resource in the account. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon FSx for Windows File Server User Guide says you can attach it to your IAM identities. It fits where read-only access to Amazon FSx is intended; the console policy AmazonFSxConsoleReadOnlyAccess adds the related-service actions the console needs. ### FAQs **When should I attach AmazonFSxReadOnlyAccess?** The Amazon FSx for Windows File Server User Guide says you can attach AmazonFSxReadOnlyAccess to your IAM identities, and the reference page describes it as read only access to Amazon FSx. Attach it where viewing FSx resources is the intended scope. **What does AmazonFSxReadOnlyAccess grant?** It allows fsx:Describe* and fsx:ListTagsForResource on all resources. It has no create, update, delete or tagging actions. **What are the security risks of AmazonFSxReadOnlyAccess?** It grants no write actions, but it applies to every Amazon FSx resource in the account. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonFSxReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonFSxReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon FSx for Windows File Server (Amazon FSx for Windows File Server User Guide)](https://docs.aws.amazon.com/fsx/latest/WindowsGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKeyspacesFullAccess - Page: https://iampolicymap.com/policies/amazonkeyspacesfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKeyspacesFullAccess` - Kind: standard. Domain: databases. Default version: v8. Guide reviewed against: v8. - Tier: admin. Distinct granted actions: 37 control plane, 3 data plane, 11 unclassified. - AWS description: Provide full access to Amazon Keyspaces - Actions: https://iampolicymap.com/policies/amazonkeyspacesfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: application-autoscaling (6 of 6), cassandra (11 of 11). - 7 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon Keyspaces. The Amazon Keyspaces (for Apache Cassandra) Developer Guide says it grants administrative permissions that allow administrators unrestricted access to Amazon Keyspaces. ### Practical scope The first statement allows cassandra:* on Resource "*". Other statements allow application-autoscaling scaling policy, scheduled action and scalable target actions plus kms:DescribeKey and kms:ListAliases, CloudWatch alarm actions (DeleteAlarms, DescribeAlarms, GetMetricData, PutMetricAlarm), and ec2:DescribeNetworkInterfaces and ec2:DescribeVpcEndpoints. iam:CreateServiceLinkedRole is allowed on three named roles with matching iam:AWSServiceName conditions: AWSServiceRoleForApplicationAutoScaling_CassandraTable, AWSServiceRoleForKeyspacesReplication and AWSServiceRoleForAmazonKeyspacesCDC. ### Use cases - Give administrators unrestricted access to Amazon Keyspaces, including managing automatic scaling policies for tables and creating the service-linked roles that CDC streams, automatic scaling and multi-Region replication use. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The Amazon Keyspaces (for Apache Cassandra) Developer Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - cassandra:* allows every Amazon Keyspaces action on all resources. The Developer Guide describes this as unrestricted access to Amazon Keyspaces. - The policy also lets principals create and delete CloudWatch alarms and scaling policies, and create the three Keyspaces-related service-linked roles. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities. The reference page says users, groups and roles, and links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Developer Guide aims it at administrators. ### FAQs **When should I attach AmazonKeyspacesFullAccess?** The Amazon Keyspaces (for Apache Cassandra) Developer Guide says it grants administrative permissions for unrestricted access to Amazon Keyspaces, so attach it to administrators who need that. If a narrower scope is enough, AWS recommends customer managed policies specific to your use cases. **What does AmazonKeyspacesFullAccess grant?** It allows cassandra:* on all resources, Application Auto Scaling actions to create, view and delete scaling policies and scheduled actions for tables, CloudWatch alarm and metric-data actions, kms:DescribeKey and kms:ListAliases, read-only EC2 VPC endpoint and network interface lookups, and creating the service-linked roles for automatic scaling, multi-Region replication and CDC streams. **What are the security risks of AmazonKeyspacesFullAccess?** cassandra:* allows every Amazon Keyspaces action on all resources, which the Developer Guide describes as unrestricted access. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKeyspacesFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Keyspaces (Amazon Keyspaces (for Apache Cassandra) Developer Guide)](https://docs.aws.amazon.com/keyspaces/latest/devguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonKeyspacesReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonkeyspacesreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess` - Kind: standard. Domain: databases. Default version: v6. Guide reviewed against: v6. - Tier: reader. Distinct granted actions: 10 control plane, 3 data plane, 0 unclassified. - AWS description: Provide read only access to Amazon Keyspaces - Actions: https://iampolicymap.com/policies/amazonkeyspacesreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon Keyspaces. The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities and that it includes view access to CDC streams, Application Auto Scaling configurations, CloudWatch metrics and alarms, and AWS KMS keys. ### Practical scope The first statement allows cassandra:Select, cassandra:ListStreams, cassandra:GetStream, cassandra:GetShardIterator and cassandra:GetRecords on Resource "*". The second statement allows application-autoscaling:DescribeScalableTargets, DescribeScalingActivities, DescribeScalingPolicies and DescribeScheduledActions, cloudwatch:DescribeAlarms, cloudwatch:GetMetricData, kms:DescribeKey and kms:ListAliases on Resource "*". It has no create, update or delete actions. ### Use cases - Let users view Amazon Keyspaces, its CDC streams, the automatic scaling policies attached to a table, CloudWatch metrics and alarms for a table, and the KMS keys used with Keyspaces, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The guide describes the policy as read only, but it applies to Resource "*" and includes cassandra:Select, cassandra:GetShardIterator and cassandra:GetRecords as well as read actions for Application Auto Scaling, CloudWatch and AWS KMS. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities. It fits where read-only access to Keyspaces is intended. ### FAQs **When should I attach AmazonKeyspacesReadOnlyAccess?** The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities and that it grants read-only access to Amazon Keyspaces. Attach it where viewing Keyspaces, without changing it, is the intended scope. **What does AmazonKeyspacesReadOnlyAccess grant?** On all resources it allows cassandra:Select and four CDC stream read actions, four Application Auto Scaling Describe actions, cloudwatch:DescribeAlarms and cloudwatch:GetMetricData, and kms:DescribeKey and kms:ListAliases. **What are the security risks of AmazonKeyspacesReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and includes cassandra:Select and CDC stream read actions. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonKeyspacesReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Keyspaces](https://docs.aws.amazon.com/keyspaces/latest/devguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonKeyspacesReadOnlyAccess_v2 - Page: https://iampolicymap.com/policies/amazonkeyspacesreadonlyaccess_v2/ - ARN: `arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2` - Kind: standard. Domain: databases. Default version: v4. Guide reviewed against: v4. - Tier: reader. Distinct granted actions: 12 control plane, 3 data plane, 0 unclassified. - AWS description: Provide read only access to Amazon Keyspaces and related AWS services. - Actions: https://iampolicymap.com/policies/amazonkeyspacesreadonlyaccess_v2/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon Keyspaces and related AWS services. The Amazon Keyspaces (for Apache Cassandra) Developer Guide says it also includes the permissions needed when connecting through private VPC endpoints. ### Practical scope The first statement allows cassandra:Select, cassandra:ListStreams, cassandra:GetStream, cassandra:GetShardIterator and cassandra:GetRecords on Resource "*". The second allows four application-autoscaling Describe actions, cloudwatch:DescribeAlarms, cloudwatch:GetMetricData, kms:DescribeKey and kms:ListAliases. The third allows ec2:DescribeNetworkInterfaces and ec2:DescribeVpcEndpoints. ### Use cases - Give users read-only access to Amazon Keyspaces, including viewing CDC streams, automatic scaling policies on tables, billable table size and CloudWatch alarms. - Connect to Amazon Keyspaces through private VPC endpoints, which the policy's EC2 read-only actions support. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The Amazon Keyspaces (for Apache Cassandra) Developer Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - cassandra:Select, cassandra:GetRecords and cassandra:GetShardIterator are allowed on all resources. The Developer Guide describes the policy as read-only access that includes viewing CDC streams. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your IAM identities. The reference page says users, groups and roles, and links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon Keyspaces is intended. ### FAQs **When should I attach AmazonKeyspacesReadOnlyAccess_v2?** The Amazon Keyspaces (for Apache Cassandra) Developer Guide describes it as read-only access to Amazon Keyspaces that includes the permissions required when connecting through private VPC endpoints. Attach it to users who need to read and view but not administer. **What does AmazonKeyspacesReadOnlyAccess_v2 grant?** It allows cassandra:Select, ListStreams, GetStream, GetShardIterator and GetRecords; Application Auto Scaling describe actions; cloudwatch:DescribeAlarms and GetMetricData; kms:DescribeKey and ListAliases; and ec2:DescribeNetworkInterfaces and DescribeVpcEndpoints, all on all resources. **What are the security risks of AmazonKeyspacesReadOnlyAccess_v2?** The policy has no write actions, but its read actions, including cassandra:Select and CDC stream reads, apply to all resources. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKeyspacesReadOnlyAccess_v2 (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesReadOnlyAccess_v2.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Keyspaces (Amazon Keyspaces (for Apache Cassandra) Developer Guide)](https://docs.aws.amazon.com/keyspaces/latest/devguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonKinesisAnalyticsFullAccess - Page: https://iampolicymap.com/policies/amazonkinesisanalyticsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisAnalyticsFullAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 44 control plane, 4 data plane, 2 unclassified. - AWS description: Provides full access to Amazon Kinesis Analytics via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonkinesisanalyticsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: kinesisanalytics (20 of 20). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Amazon Kinesis Analytics via the AWS Management Console. ### Practical scope Seven statements. The first allows kinesisanalytics:* on Resource "*". Others allow kinesis:CreateStream, kinesis:DeleteStream, kinesis:DescribeStream, kinesis:ListStreams, kinesis:PutRecord and kinesis:PutRecords; firehose:DescribeDeliveryStream and firehose:ListDeliveryStreams; cloudwatch:GetMetricStatistics and cloudwatch:ListMetrics; logs:GetLogEvents; and iam:ListPolicyVersions and iam:ListRoles. The last allows iam:PassRole on roles under service-role/ whose names start with kinesis-analytics, with no iam:PassedToService condition. ### Use cases - Let users build and manage Amazon Kinesis Analytics applications in the AWS Management Console, including creating the Kinesis streams they read from and write to. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - kinesisanalytics:* and kinesis:CreateStream, kinesis:DeleteStream, kinesis:PutRecord and kinesis:PutRecords apply to all resources, so a principal can create and delete any stream and put records into it. - iam:PassRole on service-role/kinesis-analytics* roles has no iam:PassedToService condition. Passing a role to a service needs iam:PassRole. The IAM User Guide says that to pass a role to an AWS service, a user must have permission to pass the role to the service, which helps administrators ensure that only approved users can configure a service with a role that grants permissions. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full use of Amazon Kinesis Analytics in the console is intended. ### FAQs **When should I attach AmazonKinesisAnalyticsFullAccess?** The reference page says you can attach AmazonKinesisAnalyticsFullAccess to your users, groups and roles, and describes it as full access to Amazon Kinesis Analytics via the console. Attach it for people who build Kinesis Analytics applications there. **What does AmazonKinesisAnalyticsFullAccess grant?** It allows kinesisanalytics:* on all resources, six kinesis stream actions, Firehose describe and list actions, CloudWatch metric reads, logs:GetLogEvents, IAM role listing and iam:PassRole on service-role/kinesis-analytics* roles. **What are the security risks of AmazonKinesisAnalyticsFullAccess?** kinesisanalytics:* and the kinesis create, delete and put actions apply to all resources, and iam:PassRole has no service condition. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisAnalyticsFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisAnalyticsFullAccess.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKinesisAnalyticsReadOnly - Page: https://iampolicymap.com/policies/amazonkinesisanalyticsreadonly/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisAnalyticsReadOnly` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 17 control plane, 2 data plane, 1 unclassified. - AWS description: Provides read-only access to Amazon Kinesis Analytics via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonkinesisanalyticsreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Amazon Kinesis Analytics via the AWS Management Console. ### Practical scope Six statements, all on Resource "*". They allow kinesisanalytics:Describe*, kinesisanalytics:Get* and kinesisanalytics:List*; kinesis:DescribeStream and kinesis:ListStreams; firehose:DescribeDeliveryStream and firehose:ListDeliveryStreams; cloudwatch:GetMetricStatistics and cloudwatch:ListMetrics; logs:GetLogEvents; and iam:ListPolicyVersions and iam:ListRoles. It has no write actions. ### Use cases - Let users view Amazon Kinesis Analytics applications and the related streams, delivery streams and metrics in the console, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but logs:GetLogEvents on all resources lets a principal read log events, and iam:ListRoles and iam:ListPolicyVersions expose role and policy version lists. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon Kinesis Analytics is intended. ### FAQs **When should I attach AmazonKinesisAnalyticsReadOnly?** The reference page says you can attach AmazonKinesisAnalyticsReadOnly to your users, groups and roles, and describes it as read-only access to Amazon Kinesis Analytics via the console. Attach it where viewing is the intended scope. **What does AmazonKinesisAnalyticsReadOnly grant?** It allows kinesisanalytics Describe*, Get* and List* actions, two kinesis and two Firehose describe and list actions, two CloudWatch metric reads, logs:GetLogEvents and two IAM list actions, all on all resources. **What are the security risks of AmazonKinesisAnalyticsReadOnly?** It grants no write actions, but it can read log events and list IAM roles on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisAnalyticsReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisAnalyticsReadOnly.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKinesisFirehoseFullAccess - Page: https://iampolicymap.com/policies/amazonkinesisfirehosefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisFirehoseFullAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 10 control plane, 2 data plane, 0 unclassified. - AWS description: Provides full access to all Amazon Kinesis Firehose Delivery Streams. - Actions: https://iampolicymap.com/policies/amazonkinesisfirehosefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: firehose (7 of 7). ### Summary Provides full access to all Amazon Kinesis Firehose Delivery Streams. ### Practical scope One statement allows firehose:* on Resource "*". The wildcard covers every firehose action, including the create, delete and update actions and the actions that put records into a delivery stream. ### Use cases - Give users or roles full control of Amazon Kinesis Firehose delivery streams, for example to create, change and delete them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - firehose:* on all resources lets a principal create, change and delete any delivery stream and put records into it, not just view it. - The policy has no resource or condition restriction, so it is not limited to particular delivery streams. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon Kinesis Firehose delivery streams is intended. ### FAQs **When should I attach AmazonKinesisFirehoseFullAccess?** The reference page says you can attach AmazonKinesisFirehoseFullAccess to your users, groups and roles, and describes it as full access to all Amazon Kinesis Firehose delivery streams. Attach it where full control of delivery streams is intended. **What does AmazonKinesisFirehoseFullAccess grant?** It allows firehose:* on all resources. That covers every firehose action, including creating, updating and deleting delivery streams and putting records. **What are the security risks of AmazonKinesisFirehoseFullAccess?** Full access to every delivery stream means a principal can change or delete them and put records into them. The statement has no resource or condition restriction. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisFirehoseFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisFirehoseFullAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKinesisFirehoseReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonkinesisfirehosereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisFirehoseReadOnlyAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 3 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read only access to all Amazon Kinesis Firehose Delivery Streams. - Actions: https://iampolicymap.com/policies/amazonkinesisfirehosereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to all Amazon Kinesis Firehose Delivery Streams. ### Practical scope One statement allows firehose:Describe* and firehose:List* on Resource "*". There are no put, create, update or delete actions. ### Use cases - Let users or roles view Amazon Kinesis Firehose delivery streams and their details, without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources, so principals can describe and list every delivery stream in the account. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon Kinesis Firehose delivery streams is intended. ### FAQs **When should I attach AmazonKinesisFirehoseReadOnlyAccess?** The reference page says you can attach AmazonKinesisFirehoseReadOnlyAccess to your users, groups and roles, and describes it as read only access to all Amazon Kinesis Firehose delivery streams. Attach it where viewing is the intended scope. **What does AmazonKinesisFirehoseReadOnlyAccess grant?** It allows firehose:Describe* and firehose:List* on all resources. It has no put, create, update or delete actions. **What are the security risks of AmazonKinesisFirehoseReadOnlyAccess?** It grants no write actions, but it applies to all delivery streams in the account. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisFirehoseReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisFirehoseReadOnlyAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKinesisFullAccess - Page: https://iampolicymap.com/policies/amazonkinesisfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisFullAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 42 control plane, 5 data plane, 1 unclassified. - AWS description: Provides full access to all streams via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonkinesisfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: kinesis (26 of 26). ### Summary Provides full access to all streams via the AWS Management Console. ### Practical scope One statement allows kinesis:* on Resource "*". The wildcard covers every kinesis action, including stream create and delete actions and the data-plane actions that put and get records. ### Use cases - Give users or roles full control of Amazon Kinesis streams, including reading and writing records. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - kinesis:* on all resources lets a principal create and delete any stream and read and write its records, not just view it. - The policy has no resource or condition restriction, so it is not limited to particular streams. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon Kinesis streams is intended. ### FAQs **When should I attach AmazonKinesisFullAccess?** The reference page says you can attach AmazonKinesisFullAccess to your users, groups and roles, and describes it as full access to all streams via the console. Attach it where full control of streams is intended. **What does AmazonKinesisFullAccess grant?** It allows kinesis:* on all resources. That covers every kinesis action, including creating and deleting streams and putting and getting records. **What are the security risks of AmazonKinesisFullAccess?** kinesis:* lets a principal delete any stream and read and write its records, with no resource or condition restriction. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisFullAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonKinesisReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonkinesisreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonKinesisReadOnlyAccess` - Kind: standard. Domain: analytics. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 13 control plane, 2 data plane, 0 unclassified. - AWS description: Provides read only access to all streams via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonkinesisreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to all streams via the AWS Management Console. ### Practical scope One statement allows kinesis:Get*, kinesis:List* and kinesis:Describe* on Resource "*". The kinesis:Get* wildcard includes kinesis:GetRecords and kinesis:GetShardIterator, which read records from a stream. There are no put, create, update or delete actions. ### Use cases - Let users or roles view Amazon Kinesis streams and read their records, without changing the streams. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but kinesis:Get* includes kinesis:GetRecords and kinesis:GetShardIterator, so principals can read the records in every stream, not only list and describe streams. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon Kinesis streams, including their records, is intended. ### FAQs **When should I attach AmazonKinesisReadOnlyAccess?** The reference page says you can attach AmazonKinesisReadOnlyAccess to your users, groups and roles, and describes it as read only access to all streams via the console. Attach it where viewing streams and reading records is the intended scope. **What does AmazonKinesisReadOnlyAccess grant?** It allows kinesis:Get*, kinesis:List* and kinesis:Describe* on all resources, which includes kinesis:GetRecords and kinesis:GetShardIterator. It has no put, create, update or delete actions. **What are the security risks of AmazonKinesisReadOnlyAccess?** It grants no write actions, but "read only" here includes reading the records in every stream. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonKinesisReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKinesisReadOnlyAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonMCSFullAccess - Page: https://iampolicymap.com/policies/amazonmcsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonMCSFullAccess` - Kind: standard. Domain: databases. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 33 control plane, 2 data plane, 11 unclassified. - AWS description: Provide full access to Amazon Managed Apache Cassandra Service - Actions: https://iampolicymap.com/policies/amazonmcsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: application-autoscaling (6 of 6), cassandra (11 of 11). - 7 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon Managed Apache Cassandra Service, according to the reference page description. ### Practical scope One statement allows cassandra:* on Resource "*". Another allows ten application-autoscaling actions for scaling policies, scalable targets and scheduled actions, and another allows cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms and cloudwatch:PutMetricAlarm. iam:CreateServiceLinkedRole is allowed on the AWSServiceRoleForApplicationAutoScaling_CassandraTable role, with an iam:AWSServiceName condition of cassandra.application-autoscaling.amazonaws.com. ### Use cases - Give users, groups or roles full access to Amazon Managed Apache Cassandra Service, as the reference page description says. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - cassandra:* allows every Cassandra action on all resources, and the policy also allows deleting CloudWatch alarms and scaling policies on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon Managed Apache Cassandra Service is intended. ### FAQs **When should I attach AmazonMCSFullAccess?** The reference page describes it as full access to Amazon Managed Apache Cassandra Service. Attach it to users, groups or roles that need that scope. **What does AmazonMCSFullAccess grant?** It allows cassandra:* on all resources, Application Auto Scaling actions to create, view and delete scaling policies and scheduled actions, CloudWatch alarm actions (DeleteAlarms, DescribeAlarms, PutMetricAlarm), and creating the AWSServiceRoleForApplicationAutoScaling_CassandraTable service-linked role. **What are the security risks of AmazonMCSFullAccess?** cassandra:* allows every Cassandra action on all resources. You cannot change the permissions in an AWS managed policy, and AWS updates to the policy affect every identity it is attached to. The IAM User Guide says AWS managed policies don't grant least privilege permissions. ### Sources - [AmazonMCSFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonMCSFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonODBAutonomousDatabaseAdmin - Page: https://iampolicymap.com/policies/amazonodbautonomousdatabaseadmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBAutonomousDatabaseAdmin` - Kind: job-function. Domain: job-functions. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 34 control plane, 0 data plane, 2 unclassified. - AWS description: Provides administrative access to manage Autonomous Database resources in Oracle Database@AWS. - Actions: https://iampolicymap.com/policies/amazonodbautonomousdatabaseadmin/actions.json ### Tier reasons - Grants 20 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Autonomous Database resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can manage Autonomous Database Serverless resources and their backups, and view the ODB network resources they attach to. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateAutonomousDatabase, odb:UpdateAutonomousDatabase, odb:DeleteAutonomousDatabase, odb:StartAutonomousDatabase, odb:StopAutonomousDatabase, odb:RebootAutonomousDatabase, odb:ShrinkAutonomousDatabase, odb:SwitchoverAutonomousDatabase, odb:FailoverAutonomousDatabase, odb:RestoreAutonomousDatabase, the wallet and backup actions, odb:InitializeService, odb:GetOdbNetwork and odb:ListOdbNetworks. AllowEC2Actions allows ec2:DescribeAvailabilityZones. AllowSLRActions allows iam:CreateServiceLinkedRole when iam:AWSServiceName is odb.amazonaws.com. Tagging is limited to autonomous-database and autonomous-database-backup resources, and odb:CreateOutboundIntegration and odb:UpdateOutboundIntegration to autonomous-database resources. ### Use cases - Let an administrator manage Autonomous Database Serverless resources and their backups in Oracle Database@AWS, including lifecycle actions such as start, stop, reboot, shrink, switchover, failover and restore. ### Prerequisites - The policy lacks iam:PassRole and the AWS Key Management Service key describe permission. The Oracle Database@AWS User Guide says you need them when you update the encryption key on an existing Autonomous Database Serverless resource to a customer managed key, and to add them through your own customer managed policy. - The policy lacks secretsmanager:DescribeSecret. The guide says you need it only when you supply a customer managed AWS Secrets Manager secret for an Autonomous Database Serverless admin or wallet password, and that the integration also requires iam:PassRole. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteAutonomousDatabase, odb:StopAutonomousDatabase, odb:FailoverAutonomousDatabase and odb:RestoreAutonomousDatabase on Resource "*". - It allows odb:CreateAutonomousDatabaseWallet and odb:GetAutonomousDatabaseWalletDetails, which the guide describes as creating and retrieving Autonomous Database wallet details. - It allows iam:CreateServiceLinkedRole for odb.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Autonomous Database Serverless resources. ### FAQs **When should I attach AmazonODBAutonomousDatabaseAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to manage Autonomous Database Serverless resources and their backups. Add the extra permissions it lists as missing if you use customer managed KMS keys or Secrets Manager secrets. **What does AmazonODBAutonomousDatabaseAdmin grant?** On all resources it allows odb actions to create, update, delete, start, stop, reboot, shrink, switch over, fail over and restore Autonomous Databases, manage wallets and backups, and list networks and versions. It also allows ec2:DescribeAvailabilityZones, creating the odb.amazonaws.com service-linked role, and tagging and outbound integration actions on Autonomous Database resources. **What are the security risks of AmazonODBAutonomousDatabaseAdmin?** The policy can delete, stop, fail over and restore Autonomous Databases and create and retrieve wallet details on all resources. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBAutonomousDatabaseAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBAutonomousDatabaseAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonODBAutonomousVmClusterAdmin - Page: https://iampolicymap.com/policies/amazonodbautonomousvmclusteradmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBAutonomousVmClusterAdmin` - Kind: job-function. Domain: job-functions. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 24 control plane, 0 data plane, 2 unclassified. - AWS description: Provides administrative access to manage Autonomous VM cluster resources in Oracle Database@AWS - Actions: https://iampolicymap.com/policies/amazonodbautonomousvmclusteradmin/actions.json ### Tier reasons - Grants 9 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Autonomous VM cluster resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can also view the Exadata infrastructure and ODB network resources that Autonomous VM clusters depend on. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateCloudAutonomousVmCluster, odb:GetCloudAutonomousVmCluster, odb:DeleteCloudAutonomousVmCluster, odb:ListCloudAutonomousVmClusters, odb:AssociateIamRoleToResource, odb:DisassociateIamRoleFromResource, odb:ListAutonomousVirtualMachines, odb:InitializeService and read actions for Exadata infrastructure, DB servers, ODB networks, system shapes and versions. AllowEC2Actions allows ec2:DescribeAvailabilityZones. Tagging is limited to cloud-autonomous-vm-cluster resources, and odb:CreateOutboundIntegration and odb:UpdateOutboundIntegration to the same resource type. The policy has no service-linked role statement. ### Use cases - Let an administrator create, view, delete and list Autonomous VM clusters, and associate IAM roles with them, in Oracle Database@AWS. ### Prerequisites - The policy lacks iam:PassRole. The Oracle Database@AWS User Guide says to add it through your own customer managed policy, scoped to the role ARNs you choose and constrained with iam:PassedToService set to odb.amazonaws.com. Without it, requests to associate an IAM role with an Autonomous VM cluster fail. Disassociating a role does not need it. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteCloudAutonomousVmCluster and odb:AssociateIamRoleToResource on Resource "*". - The policy has no iam:PassRole. If you add it as the guide describes, scope it to role ARNs you choose, because the IAM User Guide says to make sure a user cannot pass a role that has more permissions than you want the user to have. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Autonomous VM clusters. ### FAQs **When should I attach AmazonODBAutonomousVmClusterAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to manage Autonomous VM cluster resources. Add iam:PassRole through a customer managed policy if you need to associate IAM roles. **What does AmazonODBAutonomousVmClusterAdmin grant?** On all resources it allows odb actions to create, view, delete and list Autonomous VM clusters, associate and disassociate IAM roles, list Autonomous virtual machines, and read Exadata infrastructure, DB server, ODB network and version information. It also allows ec2:DescribeAvailabilityZones, and tagging and outbound integration actions on cloud-autonomous-vm-cluster resources. **What are the security risks of AmazonODBAutonomousVmClusterAdmin?** It can delete Autonomous VM clusters and associate IAM roles on all resources. It does not include iam:PassRole. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBAutonomousVmClusterAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBAutonomousVmClusterAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonODBExadataInfrastructureAdmin - Page: https://iampolicymap.com/policies/amazonodbexadatainfrastructureadmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBExadataInfrastructureAdmin` - Kind: job-function. Domain: job-functions. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 22 control plane, 0 data plane, 3 unclassified. - AWS description: Provides administrative access to manage Exadata Infrastructure resources in Oracle Database@AWS - Actions: https://iampolicymap.com/policies/amazonodbexadatainfrastructureadmin/actions.json ### Tier reasons - Grants 9 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Exadata Infrastructure resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can create and manage Oracle Exadata infrastructure resources and list Exadata VM clusters and Autonomous VM clusters. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateCloudExadataInfrastructure, odb:UpdateCloudExadataInfrastructure, odb:DeleteCloudExadataInfrastructure, odb:GetCloudExadataInfrastructure, odb:ListCloudExadataInfrastructures, odb:ListCloudVmClusters, odb:ListCloudAutonomousVmClusters, odb:GetDbServer, odb:ListDbServers, odb:PutResourcePolicy, odb:GetResourcePolicy, odb:DeleteResourcePolicy and odb:InitializeService. AllowEC2Actions allows ec2:DescribeAvailabilityZones. AllowSLRActions allows iam:CreateServiceLinkedRole when iam:AWSServiceName is odb.amazonaws.com. Tagging is limited to cloud-exadata-infrastructure resources. ### Use cases - Let an administrator create, update, delete and list Exadata infrastructure resources in Oracle Database@AWS. ### Prerequisites - To share Exadata infrastructure across AWS accounts with AWS Resource Access Manager, you need ram:CreateResourceShare, ram:AssociateResourceShare and ram:DisassociateResourceShare. The Oracle Database@AWS User Guide says the Oracle Database@AWS managed policies do not include them. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteCloudExadataInfrastructure, odb:PutResourcePolicy and odb:DeleteResourcePolicy on Resource "*". - It allows iam:CreateServiceLinkedRole for odb.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Exadata infrastructure. ### FAQs **When should I attach AmazonODBExadataInfrastructureAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to create and manage Oracle Exadata infrastructure resources. Add RAM permissions separately if you share infrastructure across accounts. **What does AmazonODBExadataInfrastructureAdmin grant?** On all resources it allows odb actions to create, update, delete, view and list Exadata infrastructure, list VM clusters and Autonomous VM clusters, view DB servers, and put, get and delete resource policies. It also allows ec2:DescribeAvailabilityZones, creating the odb.amazonaws.com service-linked role, and tagging Exadata infrastructure resources. **What are the security risks of AmazonODBExadataInfrastructureAdmin?** The policy can delete Exadata infrastructure and put or delete resource policies on all resources, and it can create the odb.amazonaws.com service-linked role. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBExadataInfrastructureAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBExadataInfrastructureAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonODBExadataVmClusterAdmin - Page: https://iampolicymap.com/policies/amazonodbexadatavmclusteradmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBExadataVmClusterAdmin` - Kind: job-function. Domain: job-functions. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 32 control plane, 0 data plane, 2 unclassified. - AWS description: Provides administrative access to manage Exadata VM cluster resources in Oracle Database@AWS. - Actions: https://iampolicymap.com/policies/amazonodbexadatavmclusteradmin/actions.json ### Tier reasons - Grants 14 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Exadata VM cluster resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can manage Exadata VM cluster resources and their DB nodes, and view the Exadata infrastructure and ODB network resources they depend on. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateCloudVmCluster, odb:GetCloudVmCluster, odb:DeleteCloudVmCluster, odb:ListCloudVmClusters, odb:AssociateIamRoleToResource, odb:DisassociateIamRoleFromResource, odb:CreateDbNode, odb:RebootDbNode, odb:StartDbNode, odb:StopDbNode, odb:DeleteDbNode, odb:InitializeService and read actions for Exadata infrastructure, DB servers, ODB networks, system shapes and versions. AllowEC2Actions allows ec2:DescribeAvailabilityZones. Tagging is limited to cloud-vm-cluster and db-node resources, and outbound integration actions to cloud-vm-cluster resources. The policy has no service-linked role statement. ### Use cases - Let an administrator create, view, delete and list Exadata VM clusters, and create, start, stop, reboot and delete their DB nodes, in Oracle Database@AWS. ### Prerequisites - The policy lacks iam:PassRole. The Oracle Database@AWS User Guide says to add it through your own customer managed policy, scoped to the role ARNs you choose and constrained with iam:PassedToService set to odb.amazonaws.com. Without it, requests to associate an IAM role with an Exadata VM cluster fail. Disassociating a role does not need it. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteCloudVmCluster, odb:DeleteDbNode, odb:StopDbNode and odb:RebootDbNode on Resource "*". - The policy has no iam:PassRole. If you add it as the guide describes, scope it to role ARNs you choose, because the IAM User Guide says to make sure a user cannot pass a role that has more permissions than you want the user to have. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Exadata VM clusters and DB nodes. ### FAQs **When should I attach AmazonODBExadataVmClusterAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to manage Exadata VM cluster resources and their DB nodes. Add iam:PassRole through a customer managed policy if you need to associate IAM roles. **What does AmazonODBExadataVmClusterAdmin grant?** On all resources it allows odb actions to create, view, delete and list Exadata VM clusters, associate and disassociate IAM roles, create, start, stop, reboot and delete DB nodes, and read infrastructure, network and version information. It also allows ec2:DescribeAvailabilityZones, tagging actions on VM cluster and DB node resources, and outbound integration actions on VM cluster resources only. **What are the security risks of AmazonODBExadataVmClusterAdmin?** It can delete Exadata VM clusters and DB nodes, and stop or reboot DB nodes, on all resources. It does not include iam:PassRole. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBExadataVmClusterAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBExadataVmClusterAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonODBExascaleStorageVaultAdmin - Page: https://iampolicymap.com/policies/amazonodbexascalestoragevaultadmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBExascaleStorageVaultAdmin` - Kind: job-function. Domain: job-functions. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 20 control plane, 0 data plane, 3 unclassified. - AWS description: Provides administrative access to manage Exascale storage vault resources in Oracle Database@AWS. - Actions: https://iampolicymap.com/policies/amazonodbexascalestoragevaultadmin/actions.json ### Tier reasons - Grants 9 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Exascale storage vault resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can create and manage Exascale storage vault resources, list Exascale VM cluster resources and view the DB servers that use a storage vault. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateExascaleDbStorageVault, odb:UpdateExascaleDbStorageVault, odb:DeleteExascaleDbStorageVault, odb:GetExascaleDbStorageVault, odb:ListExascaleDbStorageVaults, odb:ListExadbVmClusters, odb:GetDbServer, odb:ListDbServers, odb:PutResourcePolicy, odb:GetResourcePolicy, odb:DeleteResourcePolicy and odb:InitializeService. AllowEC2Actions allows ec2:DescribeAvailabilityZones. AllowSLRActions allows iam:CreateServiceLinkedRole when iam:AWSServiceName is odb.amazonaws.com. Tagging is limited to exascale-db-storage-vault resources. ### Use cases - Let an administrator create, update, delete and list Exascale storage vault resources in Oracle Database@AWS. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteExascaleDbStorageVault, odb:PutResourcePolicy and odb:DeleteResourcePolicy on Resource "*". - It allows iam:CreateServiceLinkedRole for odb.amazonaws.com. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Exascale storage vaults. ### FAQs **When should I attach AmazonODBExascaleStorageVaultAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to create and manage Exascale storage vault resources. **What does AmazonODBExascaleStorageVaultAdmin grant?** On all resources it allows odb actions to create, update, delete, view and list Exascale storage vaults, list Exascale VM clusters, view DB servers, and put, get and delete resource policies. It also allows ec2:DescribeAvailabilityZones, creating the odb.amazonaws.com service-linked role, and tagging storage vault resources. **What are the security risks of AmazonODBExascaleStorageVaultAdmin?** The policy can delete Exascale storage vaults and put or delete resource policies on all resources, and it can create the odb.amazonaws.com service-linked role. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBExascaleStorageVaultAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBExascaleStorageVaultAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonODBExascaleVmClusterAdmin - Page: https://iampolicymap.com/policies/amazonodbexascalevmclusteradmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBExascaleVmClusterAdmin` - Kind: job-function. Domain: job-functions. Default version: v1. Guide reviewed against: v1. - Tier: operator. Distinct granted actions: 35 control plane, 0 data plane, 4 unclassified. - AWS description: Provides administrative access to manage Exascale VM cluster resources in Oracle Database@AWS. - Actions: https://iampolicymap.com/policies/amazonodbexascalevmclusteradmin/actions.json ### Tier reasons - Grants 17 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to manage Exascale VM cluster resources in Oracle Database@AWS. The Oracle Database@AWS User Guide says you can manage Exascale VM cluster resources and their DB nodes, and view the Exascale storage vault and ODB network resources they attach to. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateExadbVmCluster, odb:UpdateExadbVmCluster, odb:DeleteExadbVmCluster, odb:ListExadbVmClusters, odb:AssociateVirtualMachinesToExadbVmCluster, odb:DisassociateVirtualMachinesFromExadbVmCluster, odb:AssociateIamRoleToResource, odb:DisassociateIamRoleFromResource, odb:CreateDbNode, odb:RebootDbNode, odb:StartDbNode, odb:StopDbNode, odb:DeleteDbNode, odb:InitializeService and read actions for storage vaults, DB servers, ODB networks, system shapes and versions. AllowEC2Actions allows ec2:DescribeAvailabilityZones. Tagging is limited to exadb-vm-cluster and db-node resources, and outbound integration actions to exadb-vm-cluster resources. The policy has no service-linked role statement. ### Use cases - Let an administrator create, update, delete and list Exascale VM clusters, attach and detach virtual machines, and manage their DB nodes, in Oracle Database@AWS. ### Prerequisites - The policy lacks iam:PassRole. The Oracle Database@AWS User Guide says to add it through your own customer managed policy, scoped to the role ARNs you choose and constrained with iam:PassedToService set to odb.amazonaws.com. Without it, requests to associate an IAM role with an Exascale VM cluster fail. Disassociating a role does not need it. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteExadbVmCluster, odb:DeleteDbNode, odb:StopDbNode and odb:RebootDbNode on Resource "*". - The policy has no iam:PassRole. If you add it as the guide describes, scope it to role ARNs you choose, because the IAM User Guide says to make sure a user cannot pass a role that has more permissions than you want the user to have. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits administrators who manage Exascale VM clusters and DB nodes. ### FAQs **When should I attach AmazonODBExascaleVmClusterAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to manage Exascale VM cluster resources and their DB nodes. Add iam:PassRole through a customer managed policy if you need to associate IAM roles. **What does AmazonODBExascaleVmClusterAdmin grant?** On all resources it allows odb actions to create, update, delete and list Exascale VM clusters, attach and detach virtual machines, associate and disassociate IAM roles, manage DB nodes, and read storage vault, network and version information. It also allows ec2:DescribeAvailabilityZones, tagging actions on VM cluster and DB node resources, and outbound integration actions on VM cluster resources only. **What are the security risks of AmazonODBExascaleVmClusterAdmin?** It can delete Exascale VM clusters and DB nodes, and stop or reboot DB nodes, on all resources. It does not include iam:PassRole. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBExascaleVmClusterAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBExascaleVmClusterAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonODBNetworkAdmin - Page: https://iampolicymap.com/policies/amazonodbnetworkadmin/ - ARN: `arn:aws:iam::aws:policy/job-function/AmazonODBNetworkAdmin` - Kind: job-function. Domain: job-functions. Default version: v2. Guide reviewed against: v2. - Tier: operator. Distinct granted actions: 24 control plane, 0 data plane, 6 unclassified. - AWS description: Provides administrative access to networking resources for Oracle Database@AWS - Actions: https://iampolicymap.com/policies/amazonodbnetworkadmin/actions.json ### Tier reasons - Grants 15 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides administrative access to networking resources for Oracle Database@AWS. The Oracle Database@AWS User Guide says you can set up and manage networking resources for Oracle Database@AWS. ### Practical scope AllowODBActions allows odb actions on Resource "*", including odb:CreateOdbNetwork, odb:UpdateOdbNetwork, odb:DeleteOdbNetwork, odb:ListOdbNetworks, odb:CreateOdbPeeringConnection, odb:UpdateOdbPeeringConnection, odb:DeleteOdbPeeringConnection, odb:PutResourcePolicy, odb:GetResourcePolicy, odb:DeleteResourcePolicy and odb:InitializeService. AllowEC2Actions allows ec2:DescribeAvailabilityZones and ec2:DescribeVpcs. AllowOdbNetworkPeeringActions allows ec2:CreateOdbNetworkPeering, ec2:ModifyOdbNetworkPeering and ec2:DeleteOdbNetworkPeering on Resource "*". AllowSLRActions allows iam:CreateServiceLinkedRole when iam:AWSServiceName is odb.amazonaws.com or vpc-lattice.amazonaws.com. Tagging is limited to odb-network and odb-peering-connection resources. ### Use cases - Let an administrator create, update, delete and list ODB networks and ODB peering connections for Oracle Database@AWS. ### Prerequisites - The policy lacks Amazon VPC Lattice and Amazon EC2 VPC endpoint permissions that Oracle Database@AWS needs to provision or delete an ODB network. The Oracle Database@AWS User Guide says to add them through your own customer managed policy. - The policy lacks permissions for managing the Oracle Database@AWS managed placement group in Amazon EC2, which the guide says Oracle Database@AWS requires in Availability Zones that support managed cluster placement groups, and permissions for Amazon EC2 networking setup for ODB peering and DNS resolution. - To share ODB networks across AWS accounts with AWS Resource Access Manager, you need ram:CreateResourceShare, ram:AssociateResourceShare and ram:DisassociateResourceShare. The guide says the Oracle Database@AWS managed policies do not include them. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy allows odb:DeleteOdbNetwork, odb:DeleteOdbPeeringConnection and ec2:DeleteOdbNetworkPeering on Resource "*". - It allows iam:CreateServiceLinkedRole for odb.amazonaws.com and vpc-lattice.amazonaws.com, and odb:PutResourcePolicy and odb:DeleteResourcePolicy on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Oracle Database@AWS User Guide says you can attach it to your IAM identities. It fits network administrators who set up Oracle Database@AWS networking. ### FAQs **When should I attach AmazonODBNetworkAdmin?** The Oracle Database@AWS User Guide says you can attach it to your IAM identities to set up and manage networking resources for Oracle Database@AWS. Add the VPC Lattice, placement group and EC2 networking permissions it lists as missing through a customer managed policy. **What does AmazonODBNetworkAdmin grant?** On all resources it allows odb actions to create, update, delete and list ODB networks and peering connections, and put, get and delete resource policies. It allows ec2:DescribeAvailabilityZones, ec2:DescribeVpcs and ODB network peering create, modify and delete actions, and creating the odb.amazonaws.com and vpc-lattice.amazonaws.com service-linked roles. **What are the security risks of AmazonODBNetworkAdmin?** The policy can delete ODB networks, peering connections and network peerings, change resource policies and create two service-linked roles, all on all resources. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonODBNetworkAdmin (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonODBNetworkAdmin.md), retrieved 2026-11-13 - [AWS managed policies for Oracle Database@AWS](https://docs.aws.amazon.com/odb/latest/UserGuide/odb-security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonRDSDataFullAccess - Page: https://iampolicymap.com/policies/amazonrdsdatafullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRDSDataFullAccess` - Kind: standard. Domain: privileged. Default version: v3. Guide reviewed against: v3. - Tier: admin; High privilege. Distinct granted actions: 19 control plane, 6 data plane, 9 unclassified. - AWS description: Allows full access to use the RDS data APIs, secret store APIs for RDS database credentials, and DB console query management APIs to execute SQL statements on Aurora Serverless clusters in the AWS account. - Actions: https://iampolicymap.com/policies/amazonrdsdatafullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: rds-data (6 of 6). - Grants data-plane write actions on a data store on all resources without conditions. ### Summary Allows full access to use the RDS data APIs, the secret store APIs for RDS database credentials, and the DB console query management APIs to run SQL statements on Aurora Serverless clusters in the account. The Amazon RDS User Guide says it also allows the account to get the value of a secret from AWS Secrets Manager. ### Practical scope One statement allows secretsmanager:GetSecretValue, PutResourcePolicy, PutSecretValue, DeleteSecret, DescribeSecret and TagResource on secrets whose names begin with rds-db-credentials/. A second statement allows, on Resource "*", nine dbqms query actions (favorite queries and query history), six rds-data actions (ExecuteSql, ExecuteStatement, BatchExecuteStatement, BeginTransaction, CommitTransaction, RollbackTransaction), secretsmanager:CreateSecret, ListSecrets and GetRandomPassword, and tag:GetResources. ### Use cases - Run SQL statements on Aurora Serverless clusters with the Data API and the query editor. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The rds-data actions run SQL on Aurora Serverless databases and apply to all resources. - secretsmanager:GetSecretValue, PutSecretValue, PutResourcePolicy and DeleteSecret are allowed on all secrets under rds-db-credentials/, so holders can read, replace and delete database credentials. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon RDS User Guide says you can attach it to your IAM identities. It fits where Data API and query editor access to Aurora Serverless is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonRDSDataFullAccess?** The Amazon RDS User Guide says you can attach it to your IAM identities to allow full access to the Data API and the query editor on Aurora Serverless clusters in the account. Attach it where that scope is intended. **What does AmazonRDSDataFullAccess grant?** It allows rds-data SQL actions and dbqms query management actions on all resources, secretsmanager read, write and delete actions on rds-db-credentials/ secrets, and secretsmanager:CreateSecret, ListSecrets and GetRandomPassword. **What are the security risks of AmazonRDSDataFullAccess?** It lets holders run SQL against Aurora Serverless databases and read, replace or delete the stored database credentials under rds-db-credentials/. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonRDSDataFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRDSDataFullAccess.md), retrieved 2026-11-13 - [Identity and access management for Amazon RDS: AWS managed policies (Amazon RDS User Guide)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-security-iam-awsmanpol.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRDSFullAccess - Page: https://iampolicymap.com/policies/amazonrdsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRDSFullAccess` - Kind: standard. Domain: databases. Default version: v14. Guide reviewed against: v14. - Tier: admin. Distinct granted actions: 219 control plane, 4 data plane, 6 unclassified. - AWS description: Provides full access to Amazon RDS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonrdsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: rds (119 of 119). - 2 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon RDS via the AWS Management Console. The Amazon RDS User Guide says it also lets principals describe and manage Application Auto Scaling, manage CloudWatch alarms, get Performance Insights metrics and publish Amazon SNS messages. ### Practical scope The first statement allows rds:* plus actions for Application Auto Scaling, CloudWatch alarms and metrics, Amazon EC2 describe actions, sns:ListSubscriptions, sns:ListTopics, sns:Publish, CloudWatch Logs reads, outposts:GetOutpostInstanceTypes and devops-guru:GetResourceCollection, on Resource "*". A second statement allows pi:* on arn:aws:pi:*:*:metrics/rds/* and arn:aws:pi:*:*:perf-reports/rds/*. iam:CreateServiceLinkedRole is allowed for rds.amazonaws.com and rds.application-autoscaling.amazonaws.com. Two DevOps Guru actions are allowed only for the RDS service name. ### Use cases - Give users, groups or roles full access to Amazon RDS through the console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - rds:* allows every Amazon RDS action on all resources. The policy also allows sns:Publish and CloudWatch alarm changes (cloudwatch:PutMetricAlarm, cloudwatch:DeleteAlarms) on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon RDS User Guide says it provides full access to Amazon RDS through the AWS Management Console. It fits where full access to Amazon RDS is intended. ### FAQs **When should I attach AmazonRDSFullAccess?** The Amazon RDS User Guide says it provides full access to Amazon RDS through the AWS Management Console. Attach it where that is the intended scope. **What does AmazonRDSFullAccess grant?** It allows rds:* on all resources, plus Application Auto Scaling, CloudWatch alarm and metric actions, Amazon EC2 describe actions, Amazon SNS list and publish actions, CloudWatch Logs reads, Performance Insights (pi:*) on RDS metrics and reports, and service-linked role creation for RDS. **What are the security risks of AmazonRDSFullAccess?** rds:* allows every Amazon RDS action on all resources, and the policy also allows sns:Publish and CloudWatch alarm changes. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonRDSFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRDSFullAccess.md), retrieved 2026-11-12 - [Identity and access management for Amazon RDS: AWS managed policies (Amazon RDS User Guide)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-security-iam-awsmanpol.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRDSReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonrdsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess` - Kind: standard. Domain: databases. Default version: v7. Guide reviewed against: v7. - Tier: reader. Distinct granted actions: 62 control plane, 3 data plane, 2 unclassified. - AWS description: Provides read only access to Amazon RDS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonrdsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon RDS via the AWS Management Console. The Amazon RDS User Guide says it allows principals to describe Amazon RDS resources and list their tags, and to read related CloudWatch, Amazon EC2, CloudWatch Logs and DevOps Guru information. ### Practical scope The first statement allows rds:Describe*, rds:ListTagsForResource and Amazon EC2 describe actions for account attributes, Availability Zones, internet gateways, security groups, subnets and VPCs, on Resource "*". The second allows cloudwatch:GetMetricStatistics, cloudwatch:ListMetrics, cloudwatch:GetMetricData, logs:DescribeLogStreams, logs:GetLogEvents and devops-guru:GetResourceCollection. The third allows devops-guru:SearchInsights and devops-guru:ListAnomaliesForInsight only for the RDS service name. ### Use cases - Give users, groups or roles read-only access to Amazon RDS through the console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It lets a user read CloudWatch Logs log events (logs:GetLogEvents) on all resources, not only RDS log groups, as well as RDS metadata and metrics. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon RDS User Guide says it allows read-only access to Amazon RDS through the AWS Management Console. It fits where read-only access to Amazon RDS is intended. ### FAQs **When should I attach AmazonRDSReadOnlyAccess?** The Amazon RDS User Guide says it allows read-only access to Amazon RDS through the AWS Management Console. Attach it where viewing RDS resources is the intended scope. **What does AmazonRDSReadOnlyAccess grant?** It allows rds:Describe* and rds:ListTagsForResource, Amazon EC2 describe actions for networking resources, CloudWatch metric reads, CloudWatch Logs log stream and event reads, and DevOps Guru reads, on all resources. **What are the security risks of AmazonRDSReadOnlyAccess?** It has no write actions for Amazon RDS, but logs:GetLogEvents applies to all resources, so the user can read log events beyond RDS. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonRDSReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRDSReadOnlyAccess.md), retrieved 2026-11-12 - [Identity and access management for Amazon RDS: AWS managed policies (Amazon RDS User Guide)](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-security-iam-awsmanpol.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRedshiftDataFullAccess - Page: https://iampolicymap.com/policies/amazonredshiftdatafullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess` - Kind: standard. Domain: analytics. Default version: v5. Guide reviewed against: v5. - Tier: operator. Distinct granted actions: 15 control plane, 0 data plane, 0 unclassified. - AWS description: This policy provides full access to Amazon Redshift Data APIs. This policy also grants scoped access to other required services. - Actions: https://iampolicymap.com/policies/amazonredshiftdatafullaccess/actions.json ### Tier reasons - Grants 7 write, tagging or permissions-management actions, short of full control of any service. ### Summary Provides full access to the Amazon Redshift Data API and grants scoped access to other required services. The Amazon Redshift Management Guide says it grants full access to the Data API operations and resources for an AWS account. ### Practical scope The first statement allows ten redshift-data actions on Resource "*": BatchExecuteStatement, ExecuteStatement, CancelStatement, ListStatements, GetStatementResult, DescribeStatement, ListDatabases, ListSchemas, ListTables and DescribeTable. secretsmanager:GetSecretValue is allowed on secrets only when the secret has the tag key RedshiftDataFullAccess. redshift:GetClusterCredentials is allowed on dbname resources and on dbuser resources named redshift_data_api_user. redshift:GetClusterCredentialsWithIAM is allowed on dbname resources. redshift-serverless:GetCredentials is allowed on workgroups carrying the RedshiftDataFullAccess tag key. redshift:CreateClusterUser is denied on dbuser redshift_data_api_user resources. iam:CreateServiceLinkedRole is allowed only for the AWSServiceRoleForRedshift role when the service name is redshift-data.amazonaws.com. ### Use cases - Run and manage Amazon Redshift Data API statements for the account. - Run scheduled queries from the query editor. The Amazon Redshift Management Guide says to create an IAM role for the CloudWatch Events service and attach AmazonEventBridgeFullAccess and AmazonRedshiftDataFullAccess to it. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The redshift-data actions, including ExecuteStatement and BatchExecuteStatement, apply to all resources. - secretsmanager:GetSecretValue is limited to secrets tagged with RedshiftDataFullAccess, and redshift-serverless:GetCredentials to workgroups tagged the same way, so tag use controls what these grants reach. - redshift:GetClusterCredentials and redshift:GetClusterCredentialsWithIAM are allowed on database resources. The Amazon Redshift Management Guide describes redshift:GetClusterCredentialsWithIAM as permission to get temporary credentials to access an Amazon Redshift database. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon Redshift Management Guide also shows it attached to a role used for scheduled queries. It fits where Data API access is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonRedshiftDataFullAccess?** Attach it to users, groups or roles that need full access to the Amazon Redshift Data API. The Amazon Redshift Management Guide also says to attach it, with AmazonEventBridgeFullAccess, to the IAM role that runs scheduled queries. **What does AmazonRedshiftDataFullAccess grant?** It allows ten Data API actions on all resources, and scoped access to secrets, temporary database credentials, and the Redshift service-linked role. It denies redshift:CreateClusterUser for the redshift_data_api_user database user. **What are the security risks of AmazonRedshiftDataFullAccess?** The Data API actions apply to all resources, and the policy lets holders obtain database credentials and read tagged secrets. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonRedshiftDataFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRedshiftDataFullAccess.md), retrieved 2026-11-13 - [Using identity-based policies (IAM policies) for Amazon Redshift (Amazon Redshift Management Guide)](https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRedshiftFullAccess - Page: https://iampolicymap.com/policies/amazonredshiftfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRedshiftFullAccess` - Kind: standard. Domain: analytics. Default version: v5. Guide reviewed against: v5. - Tier: admin. Distinct granted actions: 347 control plane, 4 data plane, 41 unclassified. - AWS description: Provides full access to Amazon Redshift via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonredshiftfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: redshift (107 of 107), redshift-serverless (35 of 35). - 10 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon Redshift via the AWS Management Console. The Amazon Redshift Management Guide says it grants full access to all Amazon Redshift resources for an account, and full access to Amazon Redshift Serverless resources. ### Practical scope 5 statements, all Allow. The first allows redshift:* and redshift-serverless:* on Resource "*", plus 7 EC2 describe actions, sns:CreateTopic, sns:Get*, sns:List*, cloudwatch:Describe*, cloudwatch:Get*, cloudwatch:List*, cloudwatch:PutMetricAlarm, cloudwatch:EnableAlarmActions, cloudwatch:DisableAlarmActions, and five tag actions (tag:GetResources, tag:UntagResources, tag:GetTagValues, tag:GetTagKeys, tag:TagResources). Others allow iam:CreateServiceLinkedRole for the Amazon Redshift service-linked role, 9 redshift-data actions (DataAPIPermissions), secretsmanager:ListSecrets, and secretsmanager:CreateSecret, secretsmanager:GetSecretValue and secretsmanager:TagResource with a StringLike condition on secretsmanager:ResourceTag/RedshiftDataFullAccess. ### Use cases - Give users or roles full access to Amazon Redshift and Amazon Redshift Serverless, including the console and the Redshift Data API. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - redshift:* and redshift-serverless:* on Resource "*" allow every action in those services, not only reads. - redshift-data:ExecuteStatement is allowed, so principals can run SQL statements through the Data API. secretsmanager:GetSecretValue and secretsmanager:CreateSecret are allowed on "*" with a StringLike condition on secretsmanager:ResourceTag/RedshiftDataFullAccess, so principals can read secret values for resources carrying that tag. - It also includes cloudwatch:PutMetricAlarm, sns:CreateTopic and tag:TagResources and tag:UntagResources, which change resources outside Redshift. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon Redshift as a whole is intended. ### FAQs **When should I attach AmazonRedshiftFullAccess?** The reference page says you can attach AmazonRedshiftFullAccess to your users, groups and roles, and describes it as: provides full access to Amazon Redshift via the AWS Management Console. Attach it where full access to Amazon Redshift and Redshift Serverless is the intended scope. **What does AmazonRedshiftFullAccess grant?** It allows redshift:* and redshift-serverless:* on all resources, EC2 describe, SNS, CloudWatch and tag actions, the redshift-data actions, creation of the Redshift service-linked role, and Secrets Manager actions (ListSecrets on all resources; CreateSecret, GetSecretValue and TagResource under a resource tag condition). **What are the security risks of AmazonRedshiftFullAccess?** redshift:* and redshift-serverless:* allow every action in those services, the policy can run SQL through redshift-data:ExecuteStatement, and it can read secret values for secrets tagged RedshiftDataFullAccess. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonRedshiftFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRedshiftFullAccess.md), retrieved 2026-11-13 - [Using identity-based policies (IAM policies) for Amazon Redshift (Amazon Redshift Management Guide)](https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonRedshiftReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonredshiftreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRedshiftReadOnlyAccess` - Kind: standard. Domain: monitoring-observability. Default version: v2. Guide reviewed against: v2. - Tier: reader. Distinct granted actions: 136 control plane, 4 data plane, 22 unclassified. - AWS description: Provides read only access to Amazon Redshift via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonredshiftreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon Redshift via the AWS Management Console. The Amazon Redshift Management Guide says it grants read-only access to all Amazon Redshift resources for an AWS account. ### Practical scope One Allow statement on Resource "*": redshift:Describe*, redshift:ListRecommendations and redshift:ViewQueriesInConsole; ec2 describe actions for account attributes, addresses, availability zones, security groups, subnets, VPCs and internet gateways; sns:Get* and sns:List*; and cloudwatch:Describe*, List* and Get*. ### Use cases - Give users read-only access to Amazon Redshift resources through the console, along with the EC2, SNS and CloudWatch reads the console needs. - Add to a more restrictive IAM policy so users can still use the Amazon Redshift console. The Management Guide says to attach it when your own policy is more restrictive than the console's minimum required permissions. - Query editor access. The Management Guide says to attach both AmazonRedshiftQueryEditor and AmazonRedshiftReadOnlyAccess to give a user access to the query editor on the console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy includes redshift:ViewQueriesInConsole, and cloudwatch and sns Get and List wildcards, on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The Management Guide says to attach it to the user to restore console function when their other policy is more restrictive than the minimum console permissions. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. ### FAQs **When should I attach AmazonRedshiftReadOnlyAccess?** The Amazon Redshift Management Guide says to attach it to a user whose own IAM policy is more restrictive than the minimum console permissions, so the Amazon Redshift console still works, and to attach it together with AmazonRedshiftQueryEditor for query editor access. You don't need console permissions for users who call only the AWS CLI or the Amazon Redshift API. **What does AmazonRedshiftReadOnlyAccess grant?** It allows redshift:Describe*, redshift:ListRecommendations and redshift:ViewQueriesInConsole, EC2 describe actions for account attributes, addresses, availability zones, security groups, subnets, VPCs and internet gateways, sns:Get* and sns:List*, and cloudwatch:Describe*, List* and Get*, all on all resources. **What are the security risks of AmazonRedshiftReadOnlyAccess?** The policy has no write actions, but its read actions apply to all resources and include redshift:ViewQueriesInConsole. The IAM User Guide says AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonRedshiftReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRedshiftReadOnlyAccess.md), retrieved 2026-11-13 - [Using identity-based policies (IAM policies) for Amazon Redshift (Amazon Redshift Management Guide)](https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRoute53FullAccess - Page: https://iampolicymap.com/policies/amazonroute53fullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRoute53FullAccess` - Kind: standard. Domain: networking-content-delivery. Default version: v8. Guide reviewed against: v8. - Tier: admin. Distinct granted actions: 126 control plane, 3 data plane, 0 unclassified. - AWS description: Provides full access to all Amazon Route 53 via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonroute53fullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: route53 (32 of 32), route53domains (22 of 22). ### Summary Provides full access to all Amazon Route 53 via the AWS Management Console, as the AWS Managed Policy Reference Guide describes it. ### Practical scope The first statement allows route53:* and route53domains:* on Resource "*", plus actions for other services: cloudfront:ListDistributions, cloudfront:GetDistributionTenantByDomain, cloudfront:GetConnectionGroup, cloudwatch:DescribeAlarms, cloudwatch:GetMetricStatistics, cloudwatch:GetMetricData, ec2:DescribeVpcs, ec2:DescribeVpcEndpoints, ec2:DescribeRegions, elasticloadbalancing:DescribeLoadBalancers, elasticbeanstalk:DescribeEnvironments, es:ListDomainNames, es:DescribeDomains, lightsail:GetContainerServices, s3:ListBucket, s3:GetBucketLocation, s3:GetBucketWebsite, sns:ListTopics, sns:ListSubscriptionsByTopic and tag:GetResources. apigateway:GET is allowed on arn:aws:apigateway:*::/domainnames. iam:CreateServiceLinkedRole is allowed on all resources when the service name is route53healthchecks.amazonaws.com. ### Use cases - Manage Amazon Route 53 and Route 53 Domains from the AWS Management Console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - route53:* and route53domains:* allow every Route 53 and Route 53 Domains action on all resources. - The policy also allows iam:CreateServiceLinkedRole on all resources, limited by condition to the route53healthchecks.amazonaws.com service name. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full Route 53 access is intended. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonRoute53FullAccess?** The reference page describes it as full access to all Amazon Route 53 via the AWS Management Console, and says you can attach it to users, groups and roles. Attach it where that scope is intended. **What does AmazonRoute53FullAccess grant?** It allows route53:* and route53domains:* on all resources, a set of read actions for CloudFront, CloudWatch, EC2, load balancing, Elastic Beanstalk, OpenSearch, Lightsail, S3, SNS and tagging, apigateway:GET on custom domain names, and creating a service-linked role for route53healthchecks.amazonaws.com. **What are the security risks of AmazonRoute53FullAccess?** route53:* and route53domains:* allow every action in both services on all resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonRoute53FullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRoute53FullAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonRoute53ReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonroute53readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonRoute53ReadOnlyAccess` - Kind: standard. Domain: networking-content-delivery. Default version: v2. Guide reviewed against: v2. - Tier: reader. Distinct granted actions: 38 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read only access to all Amazon Route 53 via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonroute53readonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to all Amazon Route 53 via the AWS Management Console, as the AWS Managed Policy Reference Guide describes it. ### Practical scope One statement allows route53:Get*, route53:List* and route53:TestDNSAnswer on Resource "*", with no Condition. ### Use cases - View Amazon Route 53 resources from the AWS Management Console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - route53:Get*, route53:List* and route53:TestDNSAnswer apply to all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where viewing Route 53 resources is the only requirement. ### FAQs **When should I attach AmazonRoute53ReadOnlyAccess?** The reference page describes it as read only access to all Amazon Route 53 via the AWS Management Console, and says you can attach it to users, groups and roles. Use it for people who only need to view Route 53. **What does AmazonRoute53ReadOnlyAccess grant?** It allows route53:Get*, route53:List* and route53:TestDNSAnswer on all resources. **What are the security risks of AmazonRoute53ReadOnlyAccess?** The permissions are limited to the three read-style actions but apply to all resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonRoute53ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonRoute53ReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonS3FullAccess - Page: https://iampolicymap.com/policies/amazons3fullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonS3FullAccess` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: admin; High privilege. Distinct granted actions: 181 control plane, 25 data plane, 62 unclassified. - AWS description: Provides full access to all buckets via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazons3fullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: s3 (84 of 84), s3-object-lambda (10 of 10). - Grants data-plane write actions on a data store on all resources without conditions. - 28 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to all buckets via the AWS Management Console. The policy allows s3:* and s3-object-lambda:* on all resources. ### Practical scope The policy's Resource is "*", so it applies to every bucket and S3 Object Lambda resource the identity can reach. Its actions are the wildcards s3:* and s3-object-lambda:*, so it is not limited to reads. ### Use cases - Give users, groups or roles full access to Amazon S3, including S3 Object Lambda. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - s3:* and s3-object-lambda:* on Resource "*" allow every S3 and S3 Object Lambda action on all resources, not only reads. - You cannot change the permissions in an AWS managed policy. When AWS updates it, the change affects every user, group and role it is attached to. Amazon S3 added S3 Object Lambda permissions to AmazonS3FullAccess on September 27, 2021. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon S3 as a whole is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AmazonS3FullAccess?** Attach it to identities that should have full access to Amazon S3 as a whole. The Amazon S3 User Guide says you can attach it to your IAM identities and that it grants permissions that allow full access to Amazon S3. If you need less, AWS recommends a customer managed policy specific to your use case. **What does AmazonS3FullAccess grant?** It allows s3:* and s3-object-lambda:* on all resources. AWS describes it as providing full access to all buckets via the AWS Management Console. Amazon S3 added the S3 Object Lambda permissions on September 27, 2021. **What are the security risks of AmazonS3FullAccess?** s3:* and s3-object-lambda:* on all resources allow every S3 and S3 Object Lambda action, not only reads. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. You cannot change the policy, and AWS updates to it affect every identity it is attached to. ### Sources - [AmazonS3FullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonS3FullAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon S3 (Amazon S3 User Guide)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-11 ## AmazonS3ReadOnlyAccess - Page: https://iampolicymap.com/policies/amazons3readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess` - Kind: standard. Domain: storage. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 84 control plane, 11 data plane, 28 unclassified. - AWS description: Provides read only access to all buckets via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazons3readonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Grants read-only access to Amazon S3. AWS describes it as providing read only access to all buckets via the AWS Management Console. The policy allows s3:Get*, s3:List* and s3:Describe*, plus s3-object-lambda:Get* and s3-object-lambda:List*, on all resources. ### Practical scope The policy's Resource is "*", so it applies to every bucket and S3 Object Lambda resource the identity can reach. It includes object reads such as s3:GetObject, not only bucket and object listings. It grants no write, delete, tagging or permissions-management actions. ### Use cases - Give users, groups or roles read-only access to Amazon S3, including S3 Object Lambda. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows reading the contents of objects (for example s3:GetObject) on all resources, not only listing buckets. - You cannot change the permissions in an AWS managed policy. When AWS updates it, the change affects every user, group and role it is attached to. AWS added s3:Describe* on August 11, 2023, and S3 Object Lambda permissions on September 27, 2021. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Amazon S3 as a whole is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AmazonS3ReadOnlyAccess?** The Amazon S3 User Guide says you can attach it to your IAM identities and that it grants read-only access to Amazon S3. Attach it where reading S3 buckets and objects is the intended scope. For narrower access, AWS recommends a customer managed policy specific to the use case. **What does AmazonS3ReadOnlyAccess grant?** It allows s3:Get*, s3:List* and s3:Describe*, plus s3-object-lambda:Get* and s3-object-lambda:List*, on all resources. It grants no write, delete, tagging or permissions-management actions. **What are the security risks of AmazonS3ReadOnlyAccess?** The policy allows reading the contents of objects (for example s3:GetObject) in every bucket the identity can reach, not only listing them. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonS3ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonS3ReadOnlyAccess.md), retrieved 2026-11-11 - [AWS managed policies for Amazon S3 (Amazon S3 User Guide)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-11 ## AmazonSNSFullAccess - Page: https://iampolicymap.com/policies/amazonsnsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSNSFullAccess` - Kind: standard. Domain: application-integration. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 51 control plane, 2 data plane, 0 unclassified. - AWS description: Provides full access to Amazon SNS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonsnsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: sns (22 of 22). ### Summary Provides full access to Amazon SNS via the AWS Management Console. The policy allows sns:* on all resources, plus a list of AWS End User Messaging SMS (sms-voice) actions that apply only when called through Amazon SNS. ### Practical scope The first statement allows sns:*, which the Amazon SNS Developer Guide describes as full permissions to perform any action related to Amazon SNS. The second statement allows a list of sms-voice actions on Resource "*" with a StringEquals condition of aws:CalledViaLast set to sns.amazonaws.com, so they apply only when called through Amazon SNS. They include sms-voice:SendTextMessage, sms-voice:CreateVerifiedDestinationNumber and sms-voice:SetTextMessageSpendLimitOverride. ### Use cases - Give users, groups or roles full access to Amazon SNS, including the SMS actions needed when working through Amazon SNS. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - sms-voice:SetTextMessageSpendLimitOverride allows setting or overriding the spending limit for SMS text messaging within the AWS account, and sms-voice:SendTextMessage allows sending a text message to a recipient's phone number. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. Amazon SNS updated AmazonSNSFullAccess on 09/24/2024. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon SNS is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AmazonSNSFullAccess?** The Amazon SNS Developer Guide says it provides full access to Amazon SNS using the AWS Management Console and that you can attach it to your users, groups or roles. Attach it where that is the intended scope. If you need less, AWS recommends a customer managed policy specific to your use case. **What does AmazonSNSFullAccess grant?** It allows sns:* on all resources. It also allows these sms-voice actions on all resources, but only when called via Amazon SNS: DescribeVerifiedDestinationNumbers, CreateVerifiedDestinationNumber, SendDestinationNumberVerificationCode, SendTextMessage, DeleteVerifiedDestinationNumber, VerifyDestinationNumber, DescribeAccountAttributes, DescribeSpendLimits, DescribePhoneNumbers, SetTextMessageSpendLimitOverride, DescribeOptedOutNumbers and DeleteOptedOutNumber. **What are the security risks of AmazonSNSFullAccess?** sns:* allows every Amazon SNS action on all resources. The SMS actions include sending text messages and setting or overriding the account's SMS spending limit. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSNSFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSNSFullAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon SNS (Amazon SNS Developer Guide)](https://docs.aws.amazon.com/sns/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-12 ## AmazonSNSReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonsnsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess` - Kind: standard. Domain: application-integration. Default version: v2. Guide reviewed against: v2. - Tier: reader. Distinct granted actions: 22 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read only access to Amazon SNS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonsnsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon SNS via the AWS Management Console. The policy also includes read-only actions for AWS End User Messaging SMS (sms-voice) that apply only when called through Amazon SNS. ### Practical scope The first statement (SNSReadOnlyAccess) allows sns:GetTopicAttributes, sns:List*, sns:CheckIfPhoneNumberIsOptedOut, sns:GetEndpointAttributes, sns:GetDataProtectionPolicy, sns:GetPlatformApplicationAttributes, sns:GetSMSAttributes, sns:GetSMSSandboxAccountStatus and sns:GetSubscriptionAttributes on Resource "*". The second statement (SMSAccessViaSNS) allows sms-voice:Describe* actions on Resource "*" only when aws:CalledViaLast equals sns.amazonaws.com. ### Use cases - Give users, groups or roles read-only access to Amazon SNS, including the read-only SMS actions available through Amazon SNS. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - It lets a user view SMS account details, including verified destination numbers, phone numbers used for SMS messaging, opted-out numbers and spend limits, through sms-voice:Describe* actions called via Amazon SNS. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SNS Developer Guide says you can attach it to your users, groups and roles. It fits where read-only access to Amazon SNS is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach AmazonSNSReadOnlyAccess?** The Amazon SNS Developer Guide says it provides read-only access to Amazon SNS using the AWS Management Console and that you can attach it to your users, groups and roles. Attach it where viewing SNS is the intended scope. **What does AmazonSNSReadOnlyAccess grant?** It allows sns:GetTopicAttributes, sns:List*, sns:CheckIfPhoneNumberIsOptedOut and several other sns:Get* actions on all resources, plus five sms-voice:Describe* actions that apply only when called through Amazon SNS. **What are the security risks of AmazonSNSReadOnlyAccess?** It has no publish, subscribe or delete action, but it can show SMS account details such as verified destination numbers, opted-out numbers and spend limits. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSNSReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSNSReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon SNS (Amazon SNS Developer Guide)](https://docs.aws.amazon.com/sns/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonSQSFullAccess - Page: https://iampolicymap.com/policies/amazonsqsfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSQSFullAccess` - Kind: standard. Domain: application-integration. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 20 control plane, 0 data plane, 20 unclassified. - AWS description: Provides full access to Amazon SQS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonsqsfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: sqs (11 of 11). ### Summary Provides full access to Amazon SQS via the AWS Management Console. The Amazon SQS Developer Guide says it grants permissions that allow full access to Amazon SQS. ### Practical scope The policy is a single statement that allows sqs:* on Resource "*". It has no actions for other services. ### Use cases - Give users, groups or roles full access to Amazon SQS. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - sqs:* allows every Amazon SQS action on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SQS Developer Guide says you can attach it to your Amazon SQS identities. It fits where full access to Amazon SQS is intended. ### FAQs **When should I attach AmazonSQSFullAccess?** The Amazon SQS Developer Guide says you can attach it to your Amazon SQS identities and that it grants full access to Amazon SQS. Attach it where that is the intended scope. **What does AmazonSQSFullAccess grant?** It allows sqs:* on Resource "*", which is every Amazon SQS action on all resources, and nothing for other services. **What are the security risks of AmazonSQSFullAccess?** sqs:* allows every Amazon SQS action on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSQSFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSQSFullAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon SQS (Amazon SQS Developer Guide)](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-access-policy-aws-managed-policies.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonSQSReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonsqsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess` - Kind: standard. Domain: application-integration. Default version: v4. Guide reviewed against: v4. - Tier: reader. Distinct granted actions: 6 control plane, 0 data plane, 6 unclassified. - AWS description: Provides read only access to Amazon SQS via the AWS Management Console. - Actions: https://iampolicymap.com/policies/amazonsqsreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon SQS via the AWS Management Console. The Amazon SQS Developer Guide says it grants permissions that allow read-only access to Amazon SQS. ### Practical scope The policy is a single statement (AmazonSQSReadOnlyAccess) on Resource "*" with six actions: sqs:GetQueueAttributes, sqs:GetQueueUrl, sqs:ListDeadLetterSourceQueues, sqs:ListQueues, sqs:ListMessageMoveTasks and sqs:ListQueueTags. It contains no sqs:ReceiveMessage action and no send, delete or purge action. ### Use cases - Give users, groups or roles read-only access to Amazon SQS. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It applies to all queues and lists them and their attributes, dead-letter source queues, message move tasks and tags. - Amazon SQS added sqs:ListQueueTags and sqs:ListMessageMoveTasks to this policy after it was first published, and updates to an AWS managed policy affect every identity it is attached to. You cannot change the permissions in an AWS managed policy. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SQS Developer Guide says you can attach it to your Amazon SQS identities. It fits where read-only access to Amazon SQS is intended. ### FAQs **When should I attach AmazonSQSReadOnlyAccess?** The Amazon SQS Developer Guide says you can attach it to your Amazon SQS identities and that it grants read-only access to Amazon SQS. Attach it where viewing queues is the intended scope. **What does AmazonSQSReadOnlyAccess grant?** It allows sqs:GetQueueAttributes, sqs:GetQueueUrl, sqs:ListDeadLetterSourceQueues, sqs:ListQueues, sqs:ListMessageMoveTasks and sqs:ListQueueTags on all resources. **What are the security risks of AmazonSQSReadOnlyAccess?** It has no send, receive, delete or purge action, but it applies to all queues and lists their attributes and tags. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSQSReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSQSReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for Amazon SQS (Amazon SQS Developer Guide)](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-access-policy-aws-managed-policies.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonSSMFullAccess - Page: https://iampolicymap.com/policies/amazonssmfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSSMFullAccess` - Kind: standard. Domain: management-governance. Default version: v4. Guide reviewed against: v4. - Tier: admin. Distinct granted actions: 313 control plane, 3 data plane, 39 unclassified. - AWS description: Provides full access to Amazon SSM. - Actions: https://iampolicymap.com/policies/amazonssmfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: logs (70 of 70), ssm (76 of 76). - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary Provides full access to Amazon SSM. The AWS Systems Manager User Guide describes it as an AWS managed policy that grants full access to the Systems Manager API and documents. ### Practical scope One statement on Resource "*" allows cloudwatch:PutMetricData, ds:CreateComputer, ds:DescribeDirectories, ec2:DescribeInstanceStatus, logs:*, ssm:* and ec2messages:*. A second statement allows iam:CreateServiceLinkedRole on roles under aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM* when iam:AWSServiceName matches ssm.amazonaws.com. A third allows iam:DeleteServiceLinkedRole and iam:GetServiceLinkedRoleDeletionStatus on the same role path. A fourth allows ssmmessages:CreateControlChannel, CreateDataChannel, OpenControlChannel and OpenDataChannel on Resource "*". ### Use cases - Give a user, group or role full access to the Systems Manager API and documents. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - ssm:* and logs:* apply to Resource "*", so the policy allows every Systems Manager action and every CloudWatch Logs action in the account. It also allows ec2messages:* and ds:CreateComputer. - The policy allows iam:DeleteServiceLinkedRole and iam:GetServiceLinkedRoleDeletionStatus on the Systems Manager service-linked role path, as well as creating that role. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Systems Manager User Guide says AWS managed policies are designed so you can start assigning permissions to users, groups and roles. ### FAQs **When should I attach AmazonSSMFullAccess?** Attach it to users, groups or roles that need full access to the Systems Manager API and documents. It uses ssm:* and logs:* on all resources. **What does AmazonSSMFullAccess grant?** It allows ssm:*, logs:* and ec2messages:* on all resources, plus cloudwatch:PutMetricData, ds:CreateComputer, ds:DescribeDirectories, ec2:DescribeInstanceStatus and four ssmmessages channel actions. It also allows creating and deleting the Systems Manager service-linked role and checking its deletion status. **What are the security risks of AmazonSSMFullAccess?** ssm:* and logs:* on all resources give broad control of Systems Manager and CloudWatch Logs. The policy can delete the Systems Manager service-linked role. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonSSMFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonSSMReadOnlyAccess - Page: https://iampolicymap.com/policies/amazonssmreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 83 control plane, 1 data plane, 4 unclassified. - AWS description: Provides read only access to Amazon SSM. - Actions: https://iampolicymap.com/policies/amazonssmreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary Provides read only access to Amazon SSM. The AWS Systems Manager User Guide says it grants read-only access to Systems Manager API operations including Describe*, Get* and List*. ### Practical scope One statement allows ssm:Describe*, ssm:Get* and ssm:List* on Resource "*". The document uses these three wildcards and does not list individual actions, so the exact set depends on the Systems Manager actions that begin with those prefixes. ### Use cases - Give users or roles read-only access to AWS Systems Manager API operations. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The three wildcards apply to all resources. Because the document does not list the actions, review which ssm:Describe*, ssm:Get* and ssm:List* actions exist before relying on the policy to limit what principals can see. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Systems Manager User Guide says you can attach it to your IAM identities. It fits where read-only access to Systems Manager API operations is intended. ### FAQs **When should I attach AmazonSSMReadOnlyAccess?** The reference page says you can attach AmazonSSMReadOnlyAccess to your users, groups and roles, and describes it as: provides read only access to Amazon SSM. Attach it where viewing Systems Manager is the intended scope. **What does AmazonSSMReadOnlyAccess grant?** It allows ssm:Describe*, ssm:Get* and ssm:List* on all resources. The Systems Manager User Guide describes this as read-only access to Systems Manager API operations including Describe*, Get* and List*. **What are the security risks of AmazonSSMReadOnlyAccess?** It has no write actions listed, but the three wildcards cover every ssm action with those prefixes on all resources, and the document does not enumerate them. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSSMReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSSMReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonSageMakerCanvasFullAccess - Page: https://iampolicymap.com/policies/amazonsagemakercanvasfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSageMakerCanvasFullAccess` - Kind: standard. Domain: ai-machine-learning. Default version: v11. Guide reviewed against: v11. - Tier: operator. Distinct granted actions: 122 control plane, 6 data plane, 5 unclassified. - AWS description: Provides full access to Amazon SageMaker Canvas resources and operations. The policy also provides select access to related services (e.g., S3, IAM, VPC, ECR, CloudWatch Logs, Redshift, Secrets Manager, and Forecast). This policy should be … - Actions: https://iampolicymap.com/policies/amazonsagemakercanvasfullaccess/actions.json ### Tier reasons - Grants 58 write, tagging or permissions-management actions, short of full control of any service. - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Amazon SageMaker Canvas resources and operations, plus select access to related services. The Amazon SageMaker AI Developer Guide says it is intended to help customers experiment and get started with all the capabilities of SageMaker Canvas. ### Practical scope Statements allow sagemaker model package, training, processing, AutoML, hosting and endpoint actions (some on all resources, some on model-package and model-package-group ARNs, and hosting actions on ARNs containing Canvas or canvas), EC2 VPC actions (ec2:CreateVpcEndpoint and describe actions), ECR, CloudWatch Logs, Glue, Athena, Redshift Data API, Secrets Manager (by ARN or by tag), Amazon Forecast, EMR Serverless, QuickSight namespace listing, Application Auto Scaling, and S3 actions. s3:GetObject, s3:PutObject, s3:DeleteObject, s3:CreateBucket, s3:GetBucketCors and s3:GetBucketLocation apply to the patterns arn:aws:s3:::*SageMaker*, arn:aws:s3:::*Sagemaker* and arn:aws:s3:::*sagemaker*. Because * in an IAM resource pattern also matches /, these match any S3 ARN containing the word, so they cover buckets with the word in the name and objects whose key contains it in any bucket (for example arn:aws:s3:::any-bucket/sagemaker/x); for s3:CreateBucket only buckets named that way apply. s3:GetObject is also allowed on jumpstart-cache-prod-* buckets, and s3:ListBucket and s3:ListAllMyBuckets on all resources. iam:PassRole on role/* is allowed only when iam:PassedToService is sagemaker.amazonaws.com, and separately only for forecast.amazonaws.com. iam:PassRole for EMR Serverless is limited to AmazonSageMakerCanvasEMRSExecutionAccess-* roles. kms:DescribeKey requires the resource tag Source=SageMakerCanvas. ### Use cases - Use Amazon SageMaker Canvas capabilities, including building, registering and hosting models, from a SageMaker Domain or user profile. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - iam:PassRole is allowed on all roles when the target service is sagemaker.amazonaws.com or forecast.amazonaws.com. The IAM User Guide says a user needs permission to pass a role to an AWS service before the service can be configured with it. - The AWS guide says the policy is meant for experimenting and getting started. It suggests building scoped down versions for production workloads. - The policy allows s3:DeleteObject and s3:PutObject on arn:aws:s3:::*SageMaker*, *Sagemaker* and *sagemaker*, which also match objects whose key contains the word in any bucket. It also allows secretsmanager:GetSecretValue on secrets named AmazonSageMaker-* or tagged SageMaker=true. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The reference description says this policy should be attached to the Amazon SageMaker Domain/User Profile execution role. For production, the Amazon SageMaker AI Developer Guide suggests scoped down versions you build yourself. ### FAQs **When should I attach AmazonSageMakerCanvasFullAccess?** The reference description says it should be attached to the Amazon SageMaker Domain/User Profile execution role. The Amazon SageMaker AI Developer Guide says it is intended for experimenting and getting started with all SageMaker Canvas capabilities. **What does AmazonSageMakerCanvasFullAccess grant?** It allows full SageMaker Canvas operations and select access to related services: SageMaker model and training actions, S3 actions on patterns containing SageMaker, Sagemaker or sagemaker (matching buckets so named and objects with the word in the key), jumpstart-cache-prod-* reads and bucket listing, ECR, CloudWatch Logs, Redshift Data API, Secrets Manager, Forecast, Glue, Athena, EMR Serverless and Application Auto Scaling, with iam:PassRole conditioned to specific services. **What are the security risks of AmazonSageMakerCanvasFullAccess?** It can pass roles to SageMaker and Forecast, write and delete any S3 object whose ARN contains SageMaker, Sagemaker or sagemaker, including objects in other buckets with the word in the key, and read secrets named AmazonSageMaker-* or tagged SageMaker=true. The AWS guide suggests scoped down versions for production workloads. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonSageMakerCanvasFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerCanvasFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon SageMaker Canvas (Amazon SageMaker AI Developer Guide)](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol-canvas.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonSageMakerFullAccess - Page: https://iampolicymap.com/policies/amazonsagemakerfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonSageMakerFullAccess` - Kind: standard. Domain: ai-machine-learning. Default version: v29. Guide reviewed against: v29. - Tier: admin. Distinct granted actions: 721 control plane, 31 data plane, 83 unclassified. - AWS description: Provides full access to Amazon SageMaker via the AWS Management Console and SDK. Also provides select access to related services (e.g., S3, ECR, CloudWatch Logs). - Actions: https://iampolicymap.com/policies/amazonsagemakerfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: application-autoscaling (6 of 6), groundtruthlabeling (10 of 10), sagemaker (257 of 257), sagemaker-geospatial (8 of 8). - Grants data-plane write actions on a data store, but only for scoped resources or under conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to Amazon SageMaker AI via the AWS Management Console and SDK, with select access to related services such as S3, ECR and CloudWatch Logs. The Amazon SageMaker AI Developer Guide says it grants full access to SageMaker AI and SageMaker AI geospatial resources and the supported operations. ### Practical scope The first statement allows sagemaker:* and sagemaker-geospatial:* on every resource except the domain, user-profile, app, space, partner-app, flow-definition, training-plan and reserved-capacity ARN types, which later statements treat separately with their own actions, conditions and ownership checks. Other statements allow actions for services including Application Auto Scaling, CloudWatch, CodeCommit, Cognito, EC2, ECR, EFS, Glue, Lambda, CloudWatch Logs, Secrets Manager, Service Catalog, SNS, Step Functions, Athena and Redshift Data, many limited to resources whose names contain sagemaker. S3 object actions (s3:GetObject, s3:PutObject, s3:DeleteObject, s3:AbortMultipartUpload) apply to the resource patterns arn:aws:s3:::*SageMaker*, arn:aws:s3:::*Sagemaker*, arn:aws:s3:::*sagemaker* and arn:aws:s3:::*aws-glue*. Because * in an IAM resource pattern also matches /, these patterns match any S3 ARN containing that word after arn:aws:s3:::, so they cover buckets with the word in the name and also objects whose key contains it in any bucket (for example arn:aws:s3:::any-bucket/sagemaker/x). s3:GetBucketAcl and s3:PutObjectAcl use the three SageMaker spellings in the same way. s3:GetObject is also allowed on objects tagged SageMaker=true. iam:PassRole on role/* is allowed only when iam:PassedToService is sagemaker.amazonaws.com. iam:PassRole on roles with AmazonSageMaker in the name is allowed only for glue.amazonaws.com, robomaker.amazonaws.com and states.amazonaws.com. ### Use cases - Use Amazon SageMaker AI from the AWS Management Console and SDK, with select access to related services. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The Amazon SageMaker AI Developer Guide says this policy allows all IAM roles to be passed to Amazon SageMaker AI, and only roles with AmazonSageMaker in the name to be passed to AWS Glue, AWS Step Functions and AWS RoboMaker. The IAM User Guide says a user must have permission to pass a role to an AWS service before the service can be configured with that role. - The guide says the policy does not provide unrestricted Amazon S3 access, but supports buckets and objects with specific sagemaker tags. The policy JSON allows s3:DeleteObject and s3:PutObject on the pattern arn:aws:s3:::*sagemaker* (and the SageMaker, Sagemaker and aws-glue variants). Because * also matches /, that covers buckets with the word in the name and objects with the word in the key in any bucket. It also allows s3:CreateBucket on all resources. - The guide says the policy does not include permissions to create an Amazon SageMaker AI domain. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SageMaker AI Developer Guide says you can attach it to users in your account, and also says to use the most restricted policy that allows your use case. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach AmazonSageMakerFullAccess?** The Amazon SageMaker AI Developer Guide says it grants full access to SageMaker AI and SageMaker AI geospatial resources, and recommends using the most restricted policy that allows your use case. Attach it to users, groups or roles that need that scope. **What does AmazonSageMakerFullAccess grant?** It allows sagemaker:* and sagemaker-geospatial:* (with separate handling for domains, user profiles, apps, spaces and similar resources), related access to other services, S3 object actions on resource patterns containing SageMaker, Sagemaker, sagemaker or aws-glue (which also match objects in any bucket whose key contains the word), and iam:PassRole to SageMaker and, for roles with AmazonSageMaker in the name, to Glue, Step Functions and RoboMaker. **What are the security risks of AmazonSageMakerFullAccess?** It allows passing all IAM roles to SageMaker AI and deleting any S3 object whose ARN contains sagemaker, SageMaker, Sagemaker or aws-glue, including objects in other buckets with the word in the key. AWS says it grants full access to SageMaker AI resources and does not include permissions to create a domain. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonSageMakerFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon SageMaker AI (Amazon SageMaker AI Developer Guide)](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## AmazonSageMakerReadOnly - Page: https://iampolicymap.com/policies/amazonsagemakerreadonly/ - ARN: `arn:aws:iam::aws:policy/AmazonSageMakerReadOnly` - Kind: standard. Domain: ai-machine-learning. Default version: v11. Guide reviewed against: v11. - Tier: reader. Distinct granted actions: 207 control plane, 3 data plane, 17 unclassified. - AWS description: Provides read only access to Amazon SageMaker via the AWS Management Console and SDK. - Actions: https://iampolicymap.com/policies/amazonsagemakerreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon SageMaker AI via the AWS Management Console and SDK. The Amazon SageMaker AI Developer Guide says it grants read-only access to Amazon SageMaker AI resources. ### Practical scope One statement allows sagemaker:Describe*, sagemaker:List*, sagemaker:BatchGetMetrics, sagemaker:GetDeviceRegistration, sagemaker:GetDeviceFleetReport, sagemaker:GetSearchSuggestions, sagemaker:BatchGetRecord, sagemaker:GetRecord, sagemaker:Search, sagemaker:QueryLineage, sagemaker:GetLineageGroupPolicy, sagemaker:BatchDescribeModelPackage and sagemaker:GetModelPackageGroupPolicy on Resource "*". A second statement allows Application Auto Scaling describe actions, aws-marketplace:ViewSubscriptions, cloudwatch:DescribeAlarms, eight cognito-idp read actions (including cognito-idp:ListUsers and cognito-idp:ListUsersInGroup) and ecr:Describe*, all on Resource "*". ### Use cases - View Amazon SageMaker AI resources from the console and SDK. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy includes sagemaker:GetRecord, sagemaker:BatchGetRecord, sagemaker:Search and cognito-idp:ListUsers, all on Resource "*". - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SageMaker AI Developer Guide says you can attach it to users in your account. It fits where viewing SageMaker AI is the only requirement. ### FAQs **When should I attach AmazonSageMakerReadOnly?** The Amazon SageMaker AI Developer Guide says it grants read-only access to Amazon SageMaker AI resources through the console and SDK. Use it for people who only need to view SageMaker AI. **What does AmazonSageMakerReadOnly grant?** It allows sagemaker:Describe*, sagemaker:List* and a set of other read actions on all resources, plus read actions for Application Auto Scaling, CloudWatch alarms, Amazon Cognito user pools and Amazon ECR. **What are the security risks of AmazonSageMakerReadOnly?** The permissions are reads, but they include sagemaker:GetRecord, sagemaker:BatchGetRecord and cognito-idp:ListUsers on all resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [AmazonSageMakerReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for Amazon SageMaker AI (Amazon SageMaker AI Developer Guide)](https://docs.aws.amazon.com/sagemaker/latest/dg/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AmazonSecurityLakePermissionsBoundary - Page: https://iampolicymap.com/policies/amazonsecuritylakepermissionsboundary/ - ARN: `arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: operator; High privilege. Distinct granted actions: 10 control plane, 5 data plane, 7 unclassified. - AWS description: Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from a data lake, and uses this policy when creating these roles to define the boundary of th… - Actions: https://iampolicymap.com/policies/amazonsecuritylakepermissionsboundary/actions.json ### Tier reasons - Grants 6 write, tagging or permissions-management actions, short of full control of any service. - Grants data-plane write actions on a data store on all resources without conditions. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary A permissions boundary policy. Amazon Security Lake creates IAM roles for third-party custom sources to write data to a data lake and for third-party subscribers to consume data from it, and uses this policy when creating those roles to define the boundary of their permissions. ### Practical scope Seven statements: one Allow of 15 S3, KMS and SQS actions on Resource "*", and six Deny statements (one with NotAction, two with NotResource and three on KMS actions with conditions). The Allow lists s3:GetObject, s3:GetObjectVersion, s3:ListBucket, s3:ListBucketVersions, s3:PutObject, s3:GetBucketLocation, kms:Decrypt, kms:GenerateDataKey and seven sqs actions (ReceiveMessage, ChangeMessageVisibility, DeleteMessage, GetQueueUrl, SendMessage, GetQueueAttributes, ListQueues). ### Use cases - Set the maximum permissions for the IAM roles that Amazon Security Lake creates for third-party custom sources and subscribers. The Security Lake guide says you don't need to take action to use it. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - A permissions boundary sets the maximum permissions an identity-based policy can grant: an entity can perform only the actions allowed by both its identity-based policies and its boundary. The IAM User Guide says a permissions boundary limits the maximum permissions but does not grant access on its own. - DenyActionsForSecurityLake is a Deny with NotAction on Resource "*", listing the same 15 actions as the Allow. NotAction matches every action except those listed, so it denies everything outside the 15. - DenyActionsNotOnSecurityLakeBucket denies six S3 actions (GetObject, GetObjectVersion, ListBucket, ListBucketVersions, PutObject, GetBucketLocation) with NotResource arn:aws:s3:::aws-security-data-lake*, so they are denied on ARNs that do not match that pattern. DenyActionsNotOnSecurityLakeSQS does the same for seven sqs actions with NotResource arn:aws:sqs:*:*:AmazonSecurityLake*. - Three more Deny statements cover kms:Decrypt and kms:GenerateDataKey on "*": one with StringNotLike on kms:ViaService (s3.*.amazonaws.com, sqs.*.amazonaws.com), and two with Null "false" plus StringNotLikeIfExists on the kms:EncryptionContext:aws:s3:arn key (arn:aws:s3:::aws-security-data-lake*) and the kms:EncryptionContext:aws:sqs:arn key (arn:aws:sqs:*:*:AmazonSecurityLake*). - The Security Lake guide adds that if the data lake is encrypted with a customer managed AWS KMS key, kms:Decrypt and kms:GenerateDataKey permissions are added. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance The reference page says you can attach it to your users, groups and roles, and IAM can use an AWS managed policy as the permissions boundary for a user or role. In practice the Security Lake User Guide says Security Lake uses it when it creates roles for third-party custom sources and subscribers, and that you don't need to take action to use it. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. ### FAQs **When should I attach AmazonSecurityLakePermissionsBoundary?** The Security Lake User Guide says Security Lake uses this policy when it creates roles for third-party custom sources and subscribers, and that you don't need to take action to use it. The reference page says you can attach it to users, groups and roles. The IAM User Guide says a permissions boundary limits the maximum permissions but does not grant access on its own. **What does AmazonSecurityLakePermissionsBoundary grant?** It is a permissions boundary: one Allow of 15 S3, KMS and SQS actions on all resources, plus six Deny statements that deny any other action and restrict the S3, SQS and KMS actions by resource ARN pattern (aws-security-data-lake* and AmazonSecurityLake*) and by kms:ViaService and encryption context conditions. **What are the security risks of AmazonSecurityLakePermissionsBoundary?** A boundary limits permissions rather than adding them, but the Allow includes s3:GetObject, s3:PutObject, kms:Decrypt and sqs:SendMessage on "*", and the Deny statements are what narrow them. Check the NotAction and NotResource patterns match what you intend. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonSecurityLakePermissionsBoundary (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSecurityLakePermissionsBoundary.md), retrieved 2026-11-13 - [AWS managed policies for Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Permissions boundaries for IAM entities (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.md), retrieved 2026-11-13 - [IAM JSON policy elements: NotAction (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonTimestreamConsoleFullAccess - Page: https://iampolicymap.com/policies/amazontimestreamconsolefullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonTimestreamConsoleFullAccess` - Kind: standard. Domain: privileged. Default version: v13. Guide reviewed against: v13. - Tier: admin; High privilege. Distinct granted actions: 56 control plane, 5 data plane, 16 unclassified. - AWS description: Provides full access to manage Amazon Timestream using the AWS Management Console. Note that this policy also grants permissions for certain KMS operations, and operations to manage your saved queries. If using Customer managed CMK, please … - Actions: https://iampolicymap.com/policies/amazontimestreamconsolefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: timestream (18 of 18). - Grants data-plane write actions on a data store on all resources without conditions. - 3 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to manage Amazon Timestream using the AWS Management Console. The policy also grants permissions for certain KMS operations and operations to manage your saved queries. The Amazon Timestream guide covers Timestream Live Analytics. ### Practical scope 9 statements, all Allow. The first allows timestream:* on Resource "*". Others allow kms:DescribeKey, kms:ListKeys and kms:ListAliases on "*"; kms:CreateGrant on arn:aws:kms:*:*:key/* with conditions (kms:EncryptionContextKeys, kms:GrantIsForAWSResource, kms:ViaService timestream.*.amazonaws.com, aws:ResourceAccount); 9 dbqms saved-query and query-history actions; s3:ListAllMyBuckets; sns:ListTopics; iam:ListRoles; pricing:GetProducts; aws-marketplace:ViewSubscriptions; and six aws-marketplace agreement and subscribe actions limited by an aws-marketplace:ProductId condition listing 3 product IDs. The reference page says that if you use a customer managed CMK you should refer to the documentation for additional permissions needed. ### Use cases - Give users or roles full access to manage Amazon Timestream in the AWS Management Console, including saved queries. ### Prerequisites None. ### Best practices - The Amazon Timestream guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - timestream:* on Resource "*" allows every Timestream action, not only reads. - It allows kms:CreateGrant on arn:aws:kms:*:*:key/* with a Bool condition on kms:GrantIsForAWSResource and a kms:ViaService condition, and kms:DescribeKey, kms:ListKeys and kms:ListAliases on all resources. - It allows aws-marketplace:Subscribe, aws-marketplace:AcceptAgreementRequest and aws-marketplace:CreateAgreementRequest for the product IDs in the condition, and the Timestream guide says the Marketplace permissions are for creating agreements for InfluxDB Cluster with Read Replicas creation. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon Timestream guide says you can attach it to your users, groups and roles. It fits where full console access to Amazon Timestream is intended. ### FAQs **When should I attach AmazonTimestreamConsoleFullAccess?** The reference page says you can attach AmazonTimestreamConsoleFullAccess to your users, groups and roles, and describes it as: provides full access to manage Amazon Timestream using the AWS Management Console. Attach it where managing Timestream through the console is the intended scope. **What does AmazonTimestreamConsoleFullAccess grant?** It allows timestream:* on all resources, KMS key listing and describing, kms:CreateGrant under conditions, 9 dbqms saved-query actions, S3 bucket listing, SNS topic listing, IAM role listing, pricing:GetProducts and AWS Marketplace subscription and agreement actions. **What are the security risks of AmazonTimestreamConsoleFullAccess?** timestream:* allows every Timestream action, it can create KMS grants under conditions, and it includes AWS Marketplace subscribe and agreement actions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonTimestreamConsoleFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonTimestreamConsoleFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Timestream Live Analytics](https://docs.aws.amazon.com/timestream/latest/developerguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonTimestreamFullAccess - Page: https://iampolicymap.com/policies/amazontimestreamfullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonTimestreamFullAccess` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: admin; High privilege. Distinct granted actions: 35 control plane, 5 data plane, 6 unclassified. - AWS description: Provides full access to Amazon Timestream. Note that this policy also grants certain KMS operation access. If using Customer managed CMK, please refer to documentation for additional permissions needed. - Actions: https://iampolicymap.com/policies/amazontimestreamfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: timestream (18 of 18). - Grants data-plane write actions on a data store on all resources without conditions. - 3 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary Provides full access to Amazon Timestream. The policy also grants certain KMS operation access. The Amazon Timestream guide covers Timestream Live Analytics. ### Practical scope 4 statements, all Allow, all on Resource "*". They allow timestream:*, kms:DescribeKey, s3:ListAllMyBuckets, and kms:CreateGrant with conditions: ForAnyValue:StringEquals on kms:EncryptionContextKeys (aws:timestream:database-name), Bool on kms:GrantIsForAWSResource (true) and StringLike on kms:ViaService (timestream.*.amazonaws.com). The reference page says that if you use a customer managed CMK you should refer to the documentation for additional permissions needed. ### Use cases - Give users or roles full access to Amazon Timestream, including the KMS access Timestream needs. ### Prerequisites None. ### Best practices - The Amazon Timestream guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - timestream:* on Resource "*" allows every Timestream action, not only reads. - kms:CreateGrant is allowed on Resource "*", with conditions on the encryption context key, kms:GrantIsForAWSResource and kms:ViaService. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon Timestream guide says you can attach it to your users, groups and roles. It fits where full access to Amazon Timestream is intended. ### FAQs **When should I attach AmazonTimestreamFullAccess?** The reference page says you can attach AmazonTimestreamFullAccess to your users, groups and roles, and describes it as: provides full access to Amazon Timestream. Attach it where full access to Amazon Timestream is the intended scope. **What does AmazonTimestreamFullAccess grant?** It allows timestream:*, kms:DescribeKey and s3:ListAllMyBuckets on all resources, and kms:CreateGrant on all resources under conditions on kms:EncryptionContextKeys, kms:GrantIsForAWSResource and kms:ViaService. **What are the security risks of AmazonTimestreamFullAccess?** timestream:* allows every Timestream action, and kms:CreateGrant applies to all resources under the stated conditions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonTimestreamFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonTimestreamFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon Timestream Live Analytics](https://docs.aws.amazon.com/timestream/latest/developerguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AmazonZocaloFullAccess - Page: https://iampolicymap.com/policies/amazonzocalofullaccess/ - ARN: `arn:aws:iam::aws:policy/AmazonZocaloFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: admin. Distinct granted actions: 106 control plane, 0 data plane, 11 unclassified. - AWS description: Provides full access to Amazon Zocalo. - Actions: https://iampolicymap.com/policies/amazonzocalofullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: ds (60 of 60). ### Summary Provides full access to Amazon Zocalo. The policy also allows all AWS Directory Service actions and a set of Amazon EC2 networking actions. ### Practical scope The policy is a single statement on Resource "*". It allows zocalo:* and ds:*, plus these EC2 actions: ec2:AuthorizeSecurityGroupEgress, ec2:AuthorizeSecurityGroupIngress, ec2:CreateNetworkInterface, ec2:CreateSecurityGroup, ec2:CreateSubnet, ec2:CreateTags, ec2:CreateVpc, ec2:DescribeAvailabilityZones, ec2:DescribeNetworkInterfaces, ec2:DescribeSubnets, ec2:DescribeVpcs, ec2:DeleteNetworkInterface, ec2:DeleteSecurityGroup, ec2:RevokeSecurityGroupEgress and ec2:RevokeSecurityGroupIngress. ### Use cases - Give users, groups or roles full access to Amazon Zocalo. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - zocalo:* and ds:* allow every Amazon Zocalo and AWS Directory Service action on all resources. The ds:* grant is not limited to directories used by Amazon Zocalo. - The EC2 actions include creating a VPC and subnets (ec2:CreateVpc, ec2:CreateSubnet), creating and deleting security groups and network interfaces, and adding and removing security group rules. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Amazon Zocalo is intended. ### FAQs **When should I attach AmazonZocaloFullAccess?** The reference page says you can attach it to your users, groups and roles, and the description says it provides full access to Amazon Zocalo. Attach it where that scope, including full AWS Directory Service access, is intended. **What does AmazonZocaloFullAccess grant?** It allows zocalo:* and ds:* on Resource "*", plus fifteen listed EC2 actions for network interfaces, security groups, subnets and VPCs, including ec2:CreateVpc and ec2:CreateSubnet. **What are the security risks of AmazonZocaloFullAccess?** ds:* allows every AWS Directory Service action on all resources, and the EC2 actions let a principal create VPCs and subnets and change security group rules. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AmazonZocaloFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonZocaloFullAccess.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AutoScalingConsoleFullAccess - Page: https://iampolicymap.com/policies/autoscalingconsolefullaccess/ - ARN: `arn:aws:iam::aws:policy/AutoScalingConsoleFullAccess` - Kind: standard. Domain: compute. Default version: v2. Guide reviewed against: v2. - Tier: admin. Distinct granted actions: 115 control plane, 2 data plane, 1 unclassified. - AWS description: Provides full access to Auto Scaling via the AWS Management Console. - Actions: https://iampolicymap.com/policies/autoscalingconsolefullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: autoscaling (43 of 43). ### Summary Provides full access to Auto Scaling via the AWS Management Console. The Amazon EC2 Auto Scaling User Guide says this policy works when you use launch configurations, but not when you use launch templates. ### Practical scope autoscaling:* is allowed on Resource "*". The policy also allows a list of ec2: actions that includes ec2:CreateKeyPair, ec2:ImportKeyPair, ec2:CreateSecurityGroup and ec2:AuthorizeSecurityGroupIngress together with Describe actions, elasticloadbalancing:Describe*, cloudwatch:PutMetricAlarm with metric and alarm read actions, sns:ListSubscriptions and sns:ListTopics, and iam:ListRoles. iam:CreateServiceLinkedRole is allowed on all resources when iam:AWSServiceName equals autoscaling.amazonaws.com. ### Use cases - Give users full access to Amazon EC2 Auto Scaling through the AWS Management Console when you use launch configurations. ### Prerequisites - The User Guide says this policy does not work with launch templates. To use launch templates from the console, grant the additional launch-template permissions described in the Amazon EC2 Auto Scaling User Guide. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The Amazon EC2 Auto Scaling User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - autoscaling:* is allowed on all resources. - The policy also allows creating key pairs and security groups and authorizing security group ingress (ec2:CreateKeyPair, ec2:CreateSecurityGroup, ec2:AuthorizeSecurityGroupIngress) on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The Amazon EC2 Auto Scaling User Guide says you can attach its managed policies to IAM users or roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. Use it for console access with launch configurations. For API-only access the User Guide points to AutoScalingFullAccess, which grants full access from the CLI or SDKs but not the console. ### FAQs **When should I attach AutoScalingConsoleFullAccess?** The Amazon EC2 Auto Scaling User Guide says it grants full access to Amazon EC2 Auto Scaling using the AWS Management Console, and works with launch configurations but not launch templates. For launch templates, grant the extra permissions the User Guide describes. **What does AutoScalingConsoleFullAccess grant?** It allows autoscaling:* on all resources, EC2 describe actions plus creating key pairs and security groups and authorizing security group ingress, elasticloadbalancing:Describe*, CloudWatch metric and alarm actions including PutMetricAlarm, SNS topic and subscription listing, iam:ListRoles, and creating the Auto Scaling service-linked role. **What are the security risks of AutoScalingConsoleFullAccess?** autoscaling:* allows every Auto Scaling action on all resources, and the EC2 actions let principals create key pairs and security groups and authorize ingress. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AutoScalingConsoleFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AutoScalingConsoleFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EC2 Auto Scaling (Amazon EC2 Auto Scaling User Guide)](https://docs.aws.amazon.com/autoscaling/ec2/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## AutoScalingConsoleReadOnlyAccess - Page: https://iampolicymap.com/policies/autoscalingconsolereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AutoScalingConsoleReadOnlyAccess` - Kind: standard. Domain: compute. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 53 control plane, 2 data plane, 1 unclassified. - AWS description: Provides read-only access to Auto Scaling via the AWS Management Console. - Actions: https://iampolicymap.com/policies/autoscalingconsolereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Auto Scaling via the AWS Management Console. The Amazon EC2 Auto Scaling User Guide says it works when you use launch configurations, but not when you use launch templates. ### Practical scope Every statement applies to Resource "*". The actions are ec2:DescribeVpcs, ec2:DescribeVpcClassicLink, ec2:DescribeAvailabilityZones, ec2:DescribeSubnets, elasticloadbalancing:Describe*, cloudwatch:ListMetrics, cloudwatch:GetMetricStatistics, cloudwatch:Describe*, autoscaling:Describe*, sns:ListSubscriptions and sns:ListTopics. The policy has no create, modify, delete or run actions. ### Use cases - Let users view Amazon EC2 Auto Scaling groups and related settings in the console when the groups use launch configurations. ### Prerequisites - If you use launch templates from the console, the Amazon EC2 Auto Scaling User Guide says you need additional permissions specific to launch templates. This policy does not work with launch templates. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources and also reads Elastic Load Balancing, CloudWatch, SNS and EC2 network information. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon EC2 Auto Scaling User Guide lists it as granting read-only access to Amazon EC2 Auto Scaling using the console. It fits where viewing Auto Scaling in the console is intended. ### FAQs **When should I attach AutoScalingConsoleReadOnlyAccess?** The Amazon EC2 Auto Scaling User Guide says it grants read-only access to Amazon EC2 Auto Scaling using the AWS Management Console and works with launch configurations, not launch templates. Attach it where console viewing of Auto Scaling groups on launch configurations is intended. **What does AutoScalingConsoleReadOnlyAccess grant?** It allows autoscaling:Describe*, elasticloadbalancing:Describe*, cloudwatch:ListMetrics, cloudwatch:GetMetricStatistics, cloudwatch:Describe*, four EC2 describe actions, sns:ListSubscriptions and sns:ListTopics on all resources. **What are the security risks of AutoScalingConsoleReadOnlyAccess?** The policy grants no write actions, but it applies to all resources and reads beyond Auto Scaling. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [AutoScalingConsoleReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AutoScalingConsoleReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EC2 Auto Scaling](https://docs.aws.amazon.com/autoscaling/ec2/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## AutoScalingReadOnlyAccess - Page: https://iampolicymap.com/policies/autoscalingreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/AutoScalingReadOnlyAccess` - Kind: standard. Domain: compute. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 22 control plane, 0 data plane, 0 unclassified. - AWS description: Provides read-only access to Auto Scaling. - Actions: https://iampolicymap.com/policies/autoscalingreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read-only access to Auto Scaling. The Amazon EC2 Auto Scaling User Guide says it is for IAM identities that make calls only through the AWS CLI or SDKs. ### Practical scope The policy has one Allow statement: autoscaling:Describe* on Resource "*". ### Use cases - Give IAM identities read-only access to Amazon EC2 Auto Scaling for calls made through the AWS CLI or SDKs. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - AWS managed policies might not grant least-privilege permissions for your specific use cases because they are available to all AWS customers. The Amazon EC2 Auto Scaling User Guide recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy allows only autoscaling:Describe* on all resources. The User Guide describes it as read-only access for CLI or SDK calls. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The Amazon EC2 Auto Scaling User Guide says you can attach its managed policies to IAM users or roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. For read-only console access the User Guide points to AutoScalingConsoleReadOnlyAccess. ### FAQs **When should I attach AutoScalingReadOnlyAccess?** The Amazon EC2 Auto Scaling User Guide says it grants read-only access to Amazon EC2 Auto Scaling for IAM identities that make calls only through the AWS CLI or SDKs. For read-only console access it points to AutoScalingConsoleReadOnlyAccess. **What does AutoScalingReadOnlyAccess grant?** It allows autoscaling:Describe* on all resources and nothing else. **What are the security risks of AutoScalingReadOnlyAccess?** The policy allows only autoscaling:Describe* actions. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to. ### Sources - [AutoScalingReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AutoScalingReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon EC2 Auto Scaling (Amazon EC2 Auto Scaling User Guide)](https://docs.aws.amazon.com/autoscaling/ec2/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## Billing - Page: https://iampolicymap.com/policies/billing/ - ARN: `arn:aws:iam::aws:policy/job-function/Billing` - Kind: job-function. Domain: job-functions. Default version: v31. Guide reviewed against: v31. - Tier: admin. Distinct granted actions: 163 control plane, 0 data plane, 74 unclassified. - AWS description: Grants permissions for billing and cost management. This includes viewing account usage and viewing and modifying budgets and payment methods. - Actions: https://iampolicymap.com/policies/billing/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: budgets (5 of 5), invoicing (11 of 11), purchase-orders (5 of 6). ### Summary A job function policy that grants permissions for billing and cost management. This includes viewing account usage and viewing and modifying budgets and payment methods. The IAM User Guide says it grants full permissions for managing billing, costs, payment methods, budgets and reports. ### Practical scope The first statement (VisualEditor0) applies to Resource "*" and includes aws-portal:*Billing, aws-portal:*PaymentMethods, aws-portal:*Usage, budgets:ModifyBudget, budgets:ExecuteBudgetAction, payments:MakePayment, payments:CreatePaymentInstrument, payments:DeletePaymentInstrument, billing:RedeemCredits, tax:PutTaxRegistration and cur:DeleteReportDefinition. A second statement, ContractAdministration, allows contract actions such as billing:AssociateContract on arn:aws:billing::*:contract/*. ### Use cases - The Billing job function: a user who needs to view billing information, set up payments and authorize payments, and monitor the costs accumulated for the entire AWS service. - View and edit the AWS Billing and Cost Management console, including viewing account usage and modifying budgets and payment methods. ### Prerequisites - Before an IAM user or role can access the AWS Billing and Cost Management console with this policy, you must first activate IAM user and role access. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy applies to Resource "*" and includes write actions on money-related settings: payments:MakePayment, payments:DeletePaymentInstrument, payments:UpdatePaymentInstrument, billing:RedeemCredits, budgets:ModifyBudget and tax:DeleteTaxRegistration. - AWS adds permissions to Billing over time, for example new invoicing and Private Pricing permissions in its update history, and each update affects every identity the policy is attached to. You cannot change the permissions in an AWS managed policy. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. IAM user and role access to the billing console must be activated first. It fits a user who needs to view billing information, set up payments and authorize payments. ### FAQs **When should I attach Billing?** Attach it to a user who needs to view billing information, set up payments and authorize payments. It is the Billing job function. Activate IAM user and role access to the billing console first, or the permissions in the policy are not enough to open it. **What does Billing grant?** It grants full permissions for managing billing, costs, payment methods, budgets and reports. The document allows actions such as aws-portal:*Billing, aws-portal:*PaymentMethods, budgets:ModifyBudget, payments:MakePayment and billing:RedeemCredits on all resources. **What are the security risks of Billing?** It lets a user change payment methods, make payments, redeem credits and modify budgets, and AWS keeps adding permissions to it. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [Billing (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/Billing.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [AWS managed policies (AWS Billing User Guide)](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/managed-policies.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## CloudFrontReadOnlyAccess - Page: https://iampolicymap.com/policies/cloudfrontreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/CloudFrontReadOnlyAccess` - Kind: standard. Domain: networking-content-delivery. Default version: v12. Guide reviewed against: v12. - Tier: reader. Distinct granted actions: 115 control plane, 3 data plane, 5 unclassified. - AWS description: Provides access to CloudFront distribution configuration information and list distributions via the AWS Management Console. - Actions: https://iampolicymap.com/policies/cloudfrontreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides access to CloudFront distribution configuration information and lists distributions via the AWS Management Console. The Amazon CloudFront Developer Guide says it allows read-only permissions to CloudFront resources and to related services visible in the CloudFront console. ### Practical scope One statement allows, on Resource "*" with no Condition, cloudfront:Describe*, cloudfront:Get* and cloudfront:List*, cloudfront-keyvaluestore:Describe*, Get* and List*, acm:DescribeCertificate and acm:ListCertificates, iam:ListServerCertificates, route53:List*, waf:ListWebACLs and waf:GetWebACL, wafv2:ListWebACLs and wafv2:GetWebACL, ec2:DescribeIpamPools and ec2:GetIpamPoolCidrs, and pricingplanmanager:ListSubscriptions and pricingplanmanager:GetSubscription. ### Use cases - View CloudFront distributions and their configuration, and the related certificates, web ACLs and Route 53 lists shown in the CloudFront console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The Describe*, Get* and List* wildcards match every action in the CloudFront and CloudFront key value store services whose name begins that way, on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where viewing CloudFront configuration is the only requirement. ### FAQs **When should I attach CloudFrontReadOnlyAccess?** The Amazon CloudFront Developer Guide says you can attach it to your IAM identities to allow read-only permissions to CloudFront resources and to related resources visible in the console. Use it for people who only need to view CloudFront. **What does CloudFrontReadOnlyAccess grant?** It allows read-style actions for CloudFront and the CloudFront key value store, plus ACM certificate reads, IAM server certificate listing, Route 53 lists, AWS WAF web ACL reads, EC2 IPAM pool reads and pricing plan subscription reads, all on all resources. **What are the security risks of CloudFrontReadOnlyAccess?** The permissions are reads, but the wildcards cover every action matching Describe*, Get* and List* in the CloudFront services on all resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [CloudFrontReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudFrontReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Amazon CloudFront (Amazon CloudFront Developer Guide)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## CloudWatchFullAccess - Page: https://iampolicymap.com/policies/cloudwatchfullaccess/ - ARN: `arn:aws:iam::aws:policy/CloudWatchFullAccess` - Kind: standard. Domain: monitoring-observability. Default version: v4. Guide reviewed against: v4. - Tier: admin. Distinct granted actions: 361 control plane, 6 data plane, 65 unclassified. - AWS description: Provides full access to CloudWatch. - Actions: https://iampolicymap.com/policies/cloudwatchfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: cloudwatch (89 of 89), logs (70 of 70), sns (22 of 22). ### Summary Provides full access to CloudWatch. The Amazon CloudWatch User Guide says this policy is on the path to deprecation, recommends that you stop using it, and recommends CloudWatchFullAccessV2 instead. ### Practical scope 3 statements. The first allows autoscaling:Describe*, cloudwatch:*, logs:*, sns:*, iam:GetPolicy, iam:GetPolicyVersion, iam:GetRole and oam:ListSinks on Resource "*". The second allows iam:CreateServiceLinkedRole on role ARNs matching arn:aws:iam::*:role/aws-service-role/events.amazonaws.com/AWSServiceRoleForCloudWatchEvents*, with a StringLike condition on iam:AWSServiceName (events.amazonaws.com). The third allows oam:ListAttachedLinks on ARNs matching arn:aws:oam:*:*:sink/*. ### Use cases - Give existing users or roles full access to CloudWatch, including CloudWatch Logs and Amazon SNS actions. The CloudWatch User Guide recommends CloudWatchFullAccessV2 instead. ### Prerequisites None. ### Best practices - The CloudWatch User Guide recommends using CloudWatchFullAccessV2 instead of CloudWatchFullAccess. - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - cloudwatch:*, logs:* and sns:* on Resource "*" allow every action in those services, including write and delete actions, not only reads. - The CloudWatch guide says CloudWatchFullAccessV2 more properly scopes the permissions granted for other services such as Amazon SNS and Amazon EC2 Auto Scaling, and that AWS plans to deprecate CloudWatchFullAccess in the near future. This policy keeps the broader sns:* grant. - It lets a principal create the CloudWatch Events service-linked role (iam:CreateServiceLinkedRole on ARNs matching the AWSServiceRoleForCloudWatchEvents* pattern). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The CloudWatch User Guide recommends stopping use of this policy and using CloudWatchFullAccessV2 instead. ### FAQs **When should I attach CloudWatchFullAccess?** The reference page says you can attach CloudWatchFullAccess to your users, groups and roles and describes it as providing full access to CloudWatch. The CloudWatch User Guide says the policy is on the path to deprecation, recommends that you stop using it, and recommends CloudWatchFullAccessV2 instead. **What does CloudWatchFullAccess grant?** It allows cloudwatch:*, logs:* and sns:* on all resources, autoscaling:Describe*, iam:GetPolicy, iam:GetPolicyVersion, iam:GetRole, oam:ListSinks and oam:ListAttachedLinks, and iam:CreateServiceLinkedRole for the CloudWatch Events service-linked role. **What are the security risks of CloudWatchFullAccess?** cloudwatch:*, logs:* and sns:* on all resources allow every action in those services, not only reads. The CloudWatch User Guide says the policy is on the path to deprecation and that CloudWatchFullAccessV2 scopes SNS and EC2 Auto Scaling permissions more properly. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [CloudWatchFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for CloudWatch (Amazon CloudWatch User Guide)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/managed-policies-cloudwatch.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## CloudWatchFullAccessV2 - Page: https://iampolicymap.com/policies/cloudwatchfullaccessv2/ - ARN: `arn:aws:iam::aws:policy/CloudWatchFullAccessV2` - Kind: standard. Domain: monitoring-observability. Default version: v18. Guide reviewed against: v18. - Tier: admin. Distinct granted actions: 467 control plane, 20 data plane, 74 unclassified. - AWS description: Provides full access to CloudWatch. - Actions: https://iampolicymap.com/policies/cloudwatchfullaccessv2/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: application-signals (12 of 12), cloudwatch (89 of 89), logs (70 of 70), observabilityadmin (23 of 23), rum (11 of 11), synthetics (10 of 10), xray (17 of 17). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary Provides full access to CloudWatch. The Amazon CloudWatch User Guide says it grants full access to CloudWatch actions and resources, more properly scopes the permissions granted for other services such as Amazon SNS and Amazon EC2 Auto Scaling, and recommends it instead of CloudWatchFullAccess. ### Practical scope 17 statements, all Allow. CloudWatchFullAccessPermissions has 63 entries on Resource "*", including cloudwatch:*, logs:*, application-signals:*, rum:*, synthetics:*, xray:*, 45 observabilityadmin actions, autoscaling:DescribeAutoScalingGroups, autoscaling:DescribePolicies, application-autoscaling:DescribeScalingPolicies, five sns actions (CreateTopic, ListSubscriptions, ListSubscriptionsByTopic, ListTopics, Subscribe), iam:GetPolicy, iam:GetPolicyVersion, iam:GetRole and oam:ListSinks. Other statements allow iam:CreateServiceLinkedRole in 3 statements, iam:PassRole in 4 statements (each with iam:PassedToService and iam:AssociatedResourceArn conditions), s3tables actions on arn:aws:s3tables:*:*:bucket/aws-cloudwatch, CloudTrail, Service Quotas and Resource Explorer actions, and kms:DescribeKey. ### Use cases - Give users or roles full access to CloudWatch, including Logs, Application Signals, RUM, Synthetics and X-Ray, in place of CloudWatchFullAccess. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - cloudwatch:*, logs:*, application-signals:*, rum:*, synthetics:* and xray:* on Resource "*" allow every action in those services, including write and delete actions. - It includes 45 observabilityadmin actions, 14 of them organization-scoped, covering create, update and delete of telemetry rules, centralization rules and telemetry pipelines. - iam:PassRole is allowed in 4 statements (to logs.amazonaws.com, cloudwatch.amazonaws.com and telemetry-pipelines.observabilityadmin.amazonaws.com), each with conditions on iam:PassedToService and iam:AssociatedResourceArn. The IAM User Guide warns that a passed role can have more permissions than the person passing it. - It allows s3tables:CreateTableBucket and s3tables:PutTableBucketEncryption on arn:aws:s3tables:*:*:bucket/aws-cloudwatch with an aws:CalledVia condition (observabilityadmin.amazonaws.com), and s3tables:PutTableBucketPolicy on the same bucket ARN with no condition. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The CloudWatch User Guide recommends using CloudWatchFullAccessV2 instead of CloudWatchFullAccess. ### FAQs **When should I attach CloudWatchFullAccessV2?** The reference page says you can attach CloudWatchFullAccessV2 to your users, groups and roles and describes it as providing full access to CloudWatch. The CloudWatch User Guide recommends using it instead of CloudWatchFullAccess. **What does CloudWatchFullAccessV2 grant?** It allows full actions for CloudWatch, Logs, Application Signals, RUM, Synthetics and X-Ray on all resources, 45 observabilityadmin actions, selected sns, autoscaling and iam actions, service-linked role creation, iam:PassRole under conditions, and s3tables, CloudTrail, Service Quotas and Resource Explorer actions. **What are the security risks of CloudWatchFullAccessV2?** Wildcards across CloudWatch, Logs, Application Signals, RUM, Synthetics and X-Ray allow every action, including writes and deletes. It also allows organization-scoped observabilityadmin changes and iam:PassRole. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [CloudWatchFullAccessV2 (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchFullAccessV2.md), retrieved 2026-11-13 - [AWS managed policies for CloudWatch (Amazon CloudWatch User Guide)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/managed-policies-cloudwatch.md), retrieved 2026-11-13 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## CloudWatchLogsReadOnlyAccess - Page: https://iampolicymap.com/policies/cloudwatchlogsreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess` - Kind: standard. Domain: monitoring-observability. Default version: v12. Guide reviewed against: v12. - Tier: analyst. Distinct granted actions: 62 control plane, 0 data plane, 8 unclassified. - AWS description: Provides read only access to CloudWatch Logs - Actions: https://iampolicymap.com/policies/cloudwatchlogsreadonlyaccess/actions.json ### Tier reasons - Grants read access plus query or analysis actions that expose data. ### Summary Provides read only access to CloudWatch Logs. The Amazon CloudWatch Logs User Guide says it includes cloudwatch:GenerateQuery and cloudwatch:GenerateQueryResultsSummary, so users can generate a CloudWatch Logs Insights query string from a natural language prompt. ### Practical scope One statement, CloudWatchLogsReadOnlyAccess, applies to Resource "*". It allows logs:Describe*, logs:Get*, logs:List*, logs:StartQuery, logs:StopQuery, logs:TestMetricFilter, logs:FilterLogEvents, logs:StartLiveTail and logs:StopLiveTail. It also allows cloudwatch:GenerateQuery, cloudwatch:GenerateQueryResultsSummary, observabilityadmin:ListS3TableIntegrations, observabilityadmin:GetS3TableIntegration and observabilityadmin:ListTelemetryPipelines. ### Use cases - Let users view CloudWatch Logs, run Logs Insights queries and live tail sessions, and generate a query from a natural language prompt, without managing log groups. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy is described as read only, but it includes logs:StartQuery, logs:StopQuery, logs:StartLiveTail and logs:StopLiveTail, which start and stop queries and live tail sessions. It applies to Resource "*" and includes logs:Get* and logs:FilterLogEvents. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance The CloudWatch Logs User Guide says you can attach its managed policies to users and roles in your account. The reference page says you can attach this policy to your users, groups and roles, and links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. ### FAQs **When should I attach CloudWatchLogsReadOnlyAccess?** Attach it to users or roles that need read-only access to CloudWatch Logs, including running Logs Insights queries and live tail sessions. The CloudWatch Logs User Guide says it is a managed policy you can attach to users and roles in your account. **What does CloudWatchLogsReadOnlyAccess grant?** On all resources it allows logs:Describe*, logs:Get*, logs:List*, logs:StartQuery, logs:StopQuery, logs:TestMetricFilter, logs:FilterLogEvents, logs:StartLiveTail and logs:StopLiveTail. It also allows two cloudwatch query generation actions and three observabilityadmin read actions. **What are the security risks of CloudWatchLogsReadOnlyAccess?** It is read only in intent, but it starts and stops queries and live tail sessions and reads log events on all resources. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [CloudWatchLogsReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchLogsReadOnlyAccess.md), retrieved 2026-11-13 - [Identity-based policies for CloudWatch Logs (Amazon CloudWatch Logs User Guide)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## CloudWatchReadOnlyAccess - Page: https://iampolicymap.com/policies/cloudwatchreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess` - Kind: standard. Domain: monitoring-observability. Default version: v27. Guide reviewed against: v27. - Tier: operator. Distinct granted actions: 243 control plane, 15 data plane, 31 unclassified. - AWS description: Provides read only access to CloudWatch. - Actions: https://iampolicymap.com/policies/cloudwatchreadonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Provides read only access to CloudWatch. The Amazon CloudWatch User Guide says it grants read-only access to CloudWatch and related observability features. ### Practical scope 6 statements, all Allow. CloudWatchReadOnlyAccessPermissions has 40 entries on Resource "*", across application-autoscaling, application-signals, autoscaling, cloudtrail, cloudwatch, logs, oam, observabilityadmin, sns, rum, synthetics and xray. Other statements allow oam:ListAttachedLinks on arn:aws:oam:*:*:sink/*, iam:GetRole on the AWSServiceRoleForCloudWatchApplicationSignals role ARN, cloudtrail:GetChannel on ARNs matching arn:aws:cloudtrail:*:*:channel/aws-service-channel/application-signals/*, servicequotas:GetServiceQuota on 9 listed service ARNs, and resource-explorer-2:ListIndexes and resource-explorer-2:Search on two Application Signals views. ### Use cases - Give users or roles read access to CloudWatch, including metrics, alarms, Logs, Application Signals, RUM, Synthetics and X-Ray in the console. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide says to consider the security risk of granting principals more permissions than they need, and suggests using Access Analyzer to see which permissions principals use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It is not purely read-only. The list includes logs:StartQuery, logs:StopQuery, logs:TestMetricFilter, logs:StartLiveTail, logs:StopLiveTail, cloudwatch:CreateOneTimeDeepLinkCode, cloudwatch:DetectGroupOutliers, observabilityadmin:TestTelemetryPipeline, observabilityadmin:ValidateTelemetryPipelineConfiguration, xray:StartTraceRetrieval and xray:CancelTraceRetrieval. - logs:Get*, logs:Describe*, logs:FilterLogEvents, logs:StartQuery and logs:StartLiveTail apply to all resources. The CloudWatch guide says the logs permissions let users view CloudWatch Logs information and Logs Insights queries in the console, and live tail was added so users can start and stop live tail sessions. - sns:Get* and sns:List* are included so users can see the Amazon SNS topics that receive alarm notifications, and the observabilityadmin entries cover viewing telemetry rules, centralization configurations and resource telemetry data across AWS Organizations. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to CloudWatch and related observability features is intended. ### FAQs **When should I attach CloudWatchReadOnlyAccess?** The reference page says you can attach CloudWatchReadOnlyAccess to your users, groups and roles, and describes it as: provides read only access to CloudWatch. Attach it where viewing CloudWatch and related observability features is the intended scope. **What does CloudWatchReadOnlyAccess grant?** It allows 40 action entries on all resources across CloudWatch, Logs, Application Signals, RUM, Synthetics, X-Ray, SNS, observabilityadmin and others, plus narrower reads on oam, iam, cloudtrail, Service Quotas and Resource Explorer resources. **What are the security risks of CloudWatchReadOnlyAccess?** It includes actions that run or control things, such as logs:StartQuery, logs:StartLiveTail, observabilityadmin:TestTelemetryPipeline and xray:StartTraceRetrieval, and its log read actions apply to all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [CloudWatchReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/CloudWatchReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for CloudWatch (Amazon CloudWatch User Guide)](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/managed-policies-cloudwatch.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## ConsoleFullAccessFromVercel - Page: https://iampolicymap.com/policies/consolefullaccessfromvercel/ - ARN: `arn:aws:iam::aws:policy/ConsoleFullAccessFromVercel` - Kind: standard. Domain: privileged. Default version: v5. Guide reviewed against: v5. - Tier: operator; High privilege. Distinct granted actions: 254 control plane, 30 data plane, 40 unclassified. - AWS description: For use with accounts created through the Vercel Marketplace integration with AWS. Provides access to manage all resources for the services that are integrated with the Vercel Marketplace. - Actions: https://iampolicymap.com/policies/consolefullaccessfromvercel/actions.json ### Tier reasons - Grants 125 write, tagging or permissions-management actions, short of full control of any service. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 14 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary For use with accounts created through the Vercel Marketplace integration with AWS. AWS says it provides access to manage all resources for the services that are integrated with the Vercel Marketplace. ### Practical scope Statements allow, mostly on Resource "*", actions for Amazon Aurora DSQL (six dsql actions including dsql:UpdateCluster, dsql:DbConnectAdmin and dsql:DbConnect), Amazon DynamoDB (item reads and writes such as dynamodb:PutItem, dynamodb:DeleteItem and dynamodb:Scan, plus dynamodb:UpdateTable), Amazon RDS and Aurora (rds-db:connect, rds:Describe*, and cluster and instance management such as rds:ModifyDBInstance, rds:DeleteDBInstance and rds:DeleteDBCluster), Amazon OpenSearch Serverless (aoss actions), OpenSearch applications (es:GetApplication, es:UpdateApplication, es:ListApplications, es:GetDefaultApplicationSetting), Amazon S3 general purpose buckets, S3 Tables, S3 Vectors, CloudWatch alarms and metrics (including cloudwatch:PutMetricAlarm and cloudwatch:DeleteAlarms), CloudWatch Logs reads (logs:DescribeLogStreams and logs:GetLogEvents), tag key and value reads, Application Auto Scaling and freetier:GetAccountPlanState. rds:CreateDBInstance is allowed only when rds:DatabaseEngine equals aurora-postgresql. The Application Auto Scaling write actions apply only when the service namespace is dynamodb. iam:PassRole is allowed only when iam:PassedToService equals replication.s3tables.amazonaws.com. ### Use cases - Manage the services integrated with the Vercel Marketplace in an account created through the Vercel Marketplace integration with AWS. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The S3 statement allows bucket-level changes on all resources, including s3:PutBucketPolicy, s3:DeleteBucketPolicy, s3:PutBucketAcl and s3:PutObjectAcl, as well as s3:DeleteObject and s3:PutObject. - The RDS statement allows rds:DeleteDBInstance and rds:DeleteDBCluster on all resources, and the DynamoDB statement allows item reads, writes and deletes on all tables. - iam:PassRole is conditioned to replication.s3tables.amazonaws.com. The IAM User Guide says a user needs permission to pass a role to an AWS service before the service can use it. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says the policy is for use with accounts created through the Vercel Marketplace integration with AWS, so it fits only that case. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach ConsoleFullAccessFromVercel?** AWS says it is for use with accounts created through the Vercel Marketplace integration with AWS. Attach it only there, and to the users, groups or roles that should manage the integrated services. Elsewhere, use a customer managed policy specific to your use case. **What does ConsoleFullAccessFromVercel grant?** It allows actions on Aurora DSQL, DynamoDB, Amazon RDS and Aurora, OpenSearch Serverless, OpenSearch applications, S3 general purpose buckets, S3 Tables and S3 Vectors, plus CloudWatch alarms and metrics, CloudWatch Logs reads, tag key and value reads, Application Auto Scaling and a free tier plan state read. Most statements use Resource "*". **What are the security risks of ConsoleFullAccessFromVercel?** It allows changes and deletes across several data services on all resources, including bucket policy and ACL changes in S3, rds:DeleteDBInstance and rds:DeleteDBCluster, and DynamoDB item writes. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [ConsoleFullAccessFromVercel (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ConsoleFullAccessFromVercel.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## DataScientist - Page: https://iampolicymap.com/policies/datascientist/ - ARN: `arn:aws:iam::aws:policy/job-function/DataScientist` - Kind: job-function. Domain: job-functions. Default version: v6. Guide reviewed against: v6. - Tier: admin; High privilege. Distinct granted actions: 1859 control plane, 68 data plane, 271 unclassified. - AWS description: Grants permissions to AWS data analytics services. - Actions: https://iampolicymap.com/policies/datascientist/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: autoscaling (43 of 43), cloudwatch (89 of 89), dynamodb (45 of 45), elasticfilesystem (21 of 21), elasticmapreduce (54 of 54), es (73 of 73), firehose (7 of 7), kinesis (26 of 26), machinelearning (17 of 17), and 4 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 30 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary A job function policy that grants permissions to AWS data analytics services. ### Practical scope AWS says the policy grants permissions to create, manage and run queries on an Amazon EMR cluster and perform data analytics with tools such as Amazon QuickSight, with access to services such as AWS Data Pipeline, Amazon EC2, Amazon Kinesis, Amazon Machine Learning and SageMaker AI. The document allows elasticmapreduce:*, redshift:*, rds:*, dynamodb:*, kinesis:*, firehose:*, es:* and machinelearning:* in full on Resource "*", plus Amazon S3 object actions on all resources, including s3:DeleteObject and s3:PutObject, and ec2:RunInstances and ec2:TerminateInstances. One statement allows iam:PassRole for any role passed to sagemaker.amazonaws.com, and another allows it only for DataPipelineDefaultRole, DataPipelineDefaultResourceRole, EMR_EC2_DefaultRole, EMR_DefaultRole and kinesis-* roles. ### Use cases - The Data scientist job function: a user who runs Hadoop jobs and queries, and accesses and analyzes information for data analytics and business intelligence. - Passing a role to a service, such as the EMR roles for Amazon EC2 instances and for Amazon EMR, and any role to SageMaker AI. ### Prerequisites - If your users need the optional service roles, you must create a role that follows the naming convention in the policy and grant permissions to that role. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions. ### Security considerations - One statement allows iam:PassRole on any role when the role is passed to SageMaker AI; the other iam:PassRole statement is limited to the named roles. - Most actions apply to Resource "*", including full access to several data services (for example elasticmapreduce:*, redshift:*, rds:* and dynamodb:*), ec2:RunInstances and ec2:TerminateInstances, and Amazon S3 object deletes (s3:DeleteObject). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where one user runs analytics and machine learning work across several services. ### FAQs **When should I attach DataScientist?** Attach it to a user who runs Hadoop jobs and queries and accesses and analyzes information for data analytics and business intelligence. It is the Data scientist job function. **What does DataScientist grant?** It grants permissions to AWS data analytics services: create, manage and run queries on an Amazon EMR cluster and perform data analytics with tools such as Amazon QuickSight, with access to services such as AWS Data Pipeline, Amazon EC2, Amazon Kinesis, Amazon Machine Learning and SageMaker AI. **What are the security risks of DataScientist?** One statement allows passing any role to SageMaker AI, and most other actions apply to all resources, including ec2:RunInstances, ec2:TerminateInstances and full access to services such as Amazon EMR and Amazon Redshift. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [DataScientist (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/DataScientist.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## DatabaseAdministrator - Page: https://iampolicymap.com/policies/databaseadministrator/ - ARN: `arn:aws:iam::aws:policy/job-function/DatabaseAdministrator` - Kind: job-function. Domain: job-functions. Default version: v5. Guide reviewed against: v5. - Tier: admin; High privilege. Distinct granted actions: 715 control plane, 45 data plane, 84 unclassified. - AWS description: Grants full access permissions to AWS services and actions required to set up and configure AWS database services. - Actions: https://iampolicymap.com/policies/databaseadministrator/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: dynamodb (45 of 45), elasticache (54 of 54), rds (119 of 119), redshift (107 of 107). - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 30 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary A job function policy that grants full access permissions to AWS services and actions required to set up and configure AWS database services. ### Practical scope AWS says the policy grants permissions to create, configure and maintain databases, with access to AWS database services such as Amazon DynamoDB, Amazon RDS and Amazon Redshift. The document allows dynamodb:*, rds:*, redshift:* and elasticache:* in full on Resource "*", plus Amazon S3 object actions on all resources, including s3:DeleteObject*, s3:PutObject*, s3:Get* and s3:List*. It allows iam:PassRole only on roles named rds-monitoring-role, rdbms-lambda-access, lambda_exec_role, lambda-dynamodb-*, lambda-vpc-execution-role, DataPipelineDefaultRole and DataPipelineDefaultResourceRole. ### Use cases - The Database administrator job function: a user who sets up, configures and maintains databases in the AWS Cloud. - Passing a role to a service through the named service roles, for example rds-monitoring-role to monitor RDS databases and lambda-dynamodb-* to let Lambda functions act as triggers for DynamoDB tables. ### Prerequisites - If your users need the optional service roles, you must create a role that follows the naming convention in the policy and grant permissions to that role. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions. ### Security considerations - Most actions apply to Resource "*", including full access to Amazon DynamoDB, Amazon RDS, Amazon Redshift and ElastiCache (dynamodb:*, rds:*, redshift:*, elasticache:*) and delete actions such as s3:DeleteObject*, lambda:DeleteFunction, sns:DeleteTopic and datapipeline:DeletePipeline. - The policy grants iam:PassRole, which allows a user to pass a role to an AWS service. In this policy it is limited to the roles named in the IAM User Guide table. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where one user needs to set up and maintain several AWS database services. ### FAQs **When should I attach DatabaseAdministrator?** Attach it to a user who sets up, configures and maintains databases in the AWS Cloud. It is the Database administrator job function, which AWS designed to align with a common job function in the IT industry. **What does DatabaseAdministrator grant?** It grants permissions to create, configure and maintain databases, including access to Amazon DynamoDB, Amazon RDS and Amazon Redshift. The document allows dynamodb:*, rds:*, redshift:* and elasticache:* in full, plus a set of Amazon S3 object actions on all resources. **What are the security risks of DatabaseAdministrator?** Most actions apply to all resources and include full access to several database services and delete actions such as s3:DeleteObject* and lambda:DeleteFunction. It allows iam:PassRole, limited to the named roles. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [DatabaseAdministrator (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/DatabaseAdministrator.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## ElasticLoadBalancingFullAccess - Page: https://iampolicymap.com/policies/elasticloadbalancingfullaccess/ - ARN: `arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess` - Kind: standard. Domain: networking-content-delivery. Default version: v10. Guide reviewed against: v10. - Tier: admin. Distinct granted actions: 111 control plane, 0 data plane, 6 unclassified. - AWS description: Provides full access to Amazon ElasticLoadBalancing, and limited access to other services necessary to provide ElasticLoadBalancing features. - Actions: https://iampolicymap.com/policies/elasticloadbalancingfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: elasticloadbalancing (51 of 51). ### Summary Provides full access to Amazon ElasticLoadBalancing, and limited access to other services necessary to provide ElasticLoadBalancing features. The Elastic Load Balancing User Guide says it works via the AWS Management Console. ### Practical scope The policy allows elasticloadbalancing:* on Resource "*", plus ec2 actions (mostly Describe, plus ec2:ValidateSecurityGroupQuotasForInterface, ec2:GetCoipPoolUsage and ec2:GetSecurityGroupsForVpc) and cognito-idp:DescribeUserPoolClient on "*". It allows iam:CreateServiceLinkedRole only when iam:AWSServiceName is elasticloadbalancing.amazonaws.com, arc-zonal-shift:* on arn:aws:elasticloadbalancing:*:*:loadbalancer/*, and arc-zonal-shift:ListManagedResources and arc-zonal-shift:ListZonalShifts on "*". ### Use cases - Give users, groups or roles full access to Elastic Load Balancing through the console, including the EC2 reads the console needs. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - elasticloadbalancing:* allows every Elastic Load Balancing action on all resources, and arc-zonal-shift:* allows every zonal shift action on load balancers. The Elastic Load Balancing User Guide says AWS added arc-zonal-shift:* to this policy on November 28, 2023. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Elastic Load Balancing is intended. ### FAQs **When should I attach ElasticLoadBalancingFullAccess?** The Elastic Load Balancing User Guide says it gives full access to Elastic Load Balancing and limited access to other services via the AWS Management Console, and the reference page says you can attach it to your users, groups and roles. Attach it where that scope is intended. **What does ElasticLoadBalancingFullAccess grant?** It allows elasticloadbalancing:* on all resources, EC2 describe and related actions, cognito-idp:DescribeUserPoolClient, service-linked role creation for Elastic Load Balancing, and arc-zonal-shift actions. **What are the security risks of ElasticLoadBalancingFullAccess?** elasticloadbalancing:* allows every Elastic Load Balancing action on all resources, and arc-zonal-shift:* allows every zonal shift action on load balancers. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ElasticLoadBalancingFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ElasticLoadBalancingFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/managed-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## ElasticLoadBalancingReadOnly - Page: https://iampolicymap.com/policies/elasticloadbalancingreadonly/ - ARN: `arn:aws:iam::aws:policy/ElasticLoadBalancingReadOnly` - Kind: standard. Domain: networking-content-delivery. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 30 control plane, 0 data plane, 2 unclassified. - AWS description: Provides read only access to Amazon ElasticLoadBalancing and dependent services - Actions: https://iampolicymap.com/policies/elasticloadbalancingreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon ElasticLoadBalancing and dependent services. The Elastic Load Balancing User Guide describes it as read-only access to Elastic Load Balancing and dependent services. ### Practical scope The policy allows elasticloadbalancing:Describe* and elasticloadbalancing:Get*, ec2:DescribeInstances, ec2:DescribeClassicLinkInstances and ec2:DescribeSecurityGroups on Resource "*". It also allows arc-zonal-shift:GetManagedResource on arn:aws:elasticloadbalancing:*:*:loadbalancer/* and arc-zonal-shift:ListManagedResources and arc-zonal-shift:ListZonalShifts on "*". ### Use cases - Let users view Elastic Load Balancing resources and the EC2 and zonal shift information related to them without changing them. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy grants no write actions, but it applies to all resources and also reads EC2 instances and security groups and zonal shift information. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read only access to Elastic Load Balancing is intended. ### FAQs **When should I attach ElasticLoadBalancingReadOnly?** The Elastic Load Balancing User Guide says it provides read-only access to Elastic Load Balancing and dependent services, and the reference page says you can attach it to your users, groups and roles. Attach it where viewing load balancers is the intended scope. **What does ElasticLoadBalancingReadOnly grant?** It allows elasticloadbalancing:Describe* and elasticloadbalancing:Get*, three EC2 describe actions and three arc-zonal-shift read actions. **What are the security risks of ElasticLoadBalancingReadOnly?** The policy grants no write actions, but it applies to all resources and also reads EC2 instance and security group details. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ElasticLoadBalancingReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ElasticLoadBalancingReadOnly.md), retrieved 2026-11-13 - [AWS managed policies for Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/managed-policies.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## IAMAccessAdvisorReadOnly - Page: https://iampolicymap.com/policies/iamaccessadvisorreadonly/ - ARN: `arn:aws:iam::aws:policy/IAMAccessAdvisorReadOnly` - Kind: standard. Domain: security-identity-compliance. Default version: v1. Guide reviewed against: v1. - Tier: reader. Distinct granted actions: 23 control plane, 0 data plane, 0 unclassified. - AWS description: This policy grants access to read all access information provided by IAM access advisor such as service last accessed information. - Actions: https://iampolicymap.com/policies/iamaccessadvisorreadonly/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary This policy grants access to read all access information provided by IAM access advisor such as service last accessed information. ### Practical scope One statement allows 23 actions on Resource "*". For IAM it allows list actions (iam:ListRoles, iam:ListUsers, iam:ListGroups, iam:ListPolicies, iam:ListPoliciesGrantingServiceAccess), report generation (iam:GenerateServiceLastAccessedDetails, iam:GenerateOrganizationsAccessReport, iam:GenerateCredentialReport) and get actions (iam:GetRole, iam:GetPolicy, iam:GetServiceLastAccessedDetails, iam:GetServiceLastAccessedDetailsWithEntities, iam:GetOrganizationsAccessReport). For AWS Organizations it allows ten describe and list actions (organizations:DescribeAccount, DescribeOrganization, DescribeOrganizationalUnit, DescribePolicy, ListChildren, ListParents, ListPoliciesForTarget, ListRoots, ListPolicies and ListTargetsForPolicy). ### Use cases - Let reviewers see which services IAM users, roles and policies have accessed, using last accessed information, so unused permissions can be identified and removed. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - It lets a principal list every user, group, role and policy in the account and read the AWS Organizations structure and policies, because the actions apply to all resources. - The IAM User Guide notes that last accessed information for IAM identities covers only some policy types and excludes resource-based policies, access control lists, SCPs, permissions boundaries and session policies, so those reports do not show access granted by them. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where reviewing last accessed information for IAM and AWS Organizations is intended. The IAM User Guide lists the permissions needed to view last accessed information, which this policy covers in part. ### FAQs **When should I attach IAMAccessAdvisorReadOnly?** The reference page says you can attach IAMAccessAdvisorReadOnly to your users, groups and roles, and describes it as read access to all information provided by IAM access advisor. Attach it for people who review last accessed information to refine permissions. **What does IAMAccessAdvisorReadOnly grant?** It allows 23 actions on all resources: IAM list, get and report generation actions, including iam:GenerateServiceLastAccessedDetails and iam:GetServiceLastAccessedDetails, and ten AWS Organizations describe and list actions. **What are the security risks of IAMAccessAdvisorReadOnly?** It cannot change policies, but it lists all users, groups, roles and policies and reads the Organizations structure. Last accessed information for IAM identities excludes some policy types such as SCPs and permissions boundaries. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [IAMAccessAdvisorReadOnly (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMAccessAdvisorReadOnly.md), retrieved 2026-11-13 - [Refine permissions in AWS using last accessed information (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_last-accessed.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## IAMFullAccess - Page: https://iampolicymap.com/policies/iamfullaccess/ - ARN: `arn:aws:iam::aws:policy/IAMFullAccess` - Kind: standard. Domain: privileged. Default version: v2. Guide reviewed against: v2. - Tier: admin; High privilege. Distinct granted actions: 200 control plane, 0 data plane, 16 unclassified. - AWS description: Provides full access to IAM via the AWS Management Console. - Actions: https://iampolicymap.com/policies/iamfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: iam (97 of 97). - Grants iam:PassRole on all resources without conditions. - Grants permissions-management actions on iam on all resources without conditions. ### Summary Provides full access to IAM via the AWS Management Console. The policy allows iam:* plus AWS Organizations Describe and List actions, on all resources. ### Practical scope The policy has one Allow statement with Resource "*". Its Action list is iam:* together with organizations:DescribeAccount, organizations:DescribeOrganization, organizations:DescribeOrganizationalUnit, organizations:DescribePolicy, organizations:ListChildren, organizations:ListParents, organizations:ListPoliciesForTarget, organizations:ListRoots, organizations:ListPolicies and organizations:ListTargetsForPolicy. The IAM actions are not limited to reads. ### Use cases - A full access AWS managed policy for service administrators of IAM: the IAM User Guide says full access policies define permissions for service administrators by granting full access to a service, and lists IAMFullAccess as an example. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use cases because they are available to all AWS customers. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - iam:* on Resource "*" allows every IAM action on all resources, not only reads. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits service administrators who need full access to IAM. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach IAMFullAccess?** The IAM User Guide describes full access policies as defining permissions for service administrators by granting full access to a service, and lists IAMFullAccess as an example. Where you need less than full IAM access, AWS recommends defining a customer managed policy specific to your use case. **What does IAMFullAccess grant?** It allows iam:* on all resources, plus these AWS Organizations actions: DescribeAccount, DescribeOrganization, DescribeOrganizationalUnit, DescribePolicy, ListChildren, ListParents, ListPoliciesForTarget, ListRoots, ListPolicies and ListTargetsForPolicy. AWS describes it as providing full access to IAM via the AWS Management Console. **What are the security risks of IAMFullAccess?** iam:* on all resources allows every IAM action, not only reads. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. You cannot change the policy, and AWS updates to it affect every identity it is attached to. ### Sources - [IAMFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMFullAccess.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for AWS Identity and Access Management (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-12 ## IAMReadOnlyAccess - Page: https://iampolicymap.com/policies/iamreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/IAMReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v4. Guide reviewed against: v4. - Tier: reader. Distinct granted actions: 76 control plane, 0 data plane, 6 unclassified. - AWS description: Provides read only access to IAM via the AWS Management Console. - Actions: https://iampolicymap.com/policies/iamreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to IAM via the AWS Management Console. The IAM User Guide says it grants permission to get and list all IAM resources. ### Practical scope The policy allows iam:Get*, iam:List*, iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:SimulateCustomPolicy and iam:SimulatePrincipalPolicy on Resource "*". The IAM User Guide says it allows viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices. It does not include the ability to create or delete resources, or access to IAM Access Analyzer resources. ### Use cases - Give users, groups or roles read only access to IAM resources, including viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices. ### Prerequisites None. ### Best practices - AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - The policy applies to all IAM resources: iam:Get* and iam:List* allow getting and listing all IAM resources, including details on users, groups, roles, policies, identity providers and MFA devices. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read only access to IAM is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case. ### FAQs **When should I attach IAMReadOnlyAccess?** The IAM User Guide says to use it to allow read only access to IAM resources. Attach it where viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices is the intended scope. If you need less, AWS recommends a customer managed policy specific to your use case. **What does IAMReadOnlyAccess grant?** It allows iam:Get*, iam:List*, iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:SimulateCustomPolicy and iam:SimulatePrincipalPolicy on all resources. It does not include the ability to create or delete resources or access to IAM Access Analyzer resources. **What are the security risks of IAMReadOnlyAccess?** It grants no create or delete actions, but iam:Get* and iam:List* apply to all IAM resources, so the holder can view details of users, groups, roles, policies, identity providers and MFA devices. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to. ### Sources - [IAMReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for AWS Identity and Access Management (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-iam-awsmanpol.md), retrieved 2026-11-12 ## MultiPartyApprovalFullAccess - Page: https://iampolicymap.com/policies/multipartyapprovalfullaccess/ - ARN: `arn:aws:iam::aws:policy/MultiPartyApprovalFullAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v6. Guide reviewed against: v6. - Tier: admin. Distinct granted actions: 41 control plane, 0 data plane, 8 unclassified. - AWS description: Provides full access to Multi-party approval. This policy also includes related permissions to AWS Organizations and AWS IAM Identity for managing approval teams and identity sources. - Actions: https://iampolicymap.com/policies/multipartyapprovalfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: mpa (11 of 11). ### Summary Provides full access to Multi-party approval, plus related permissions to AWS Organizations and AWS IAM Identity Center for managing approval teams and identity sources. The Multi-party approval User Guide says it grants broad permissions to manage all aspects of multi-party approval workflows. ### Practical scope 7 statements, all Allow. MpaFullAccess allows mpa:* on Resource "*". OrganizationsAccess allows organizations:ListDelegatedAdministrators and organizations:DescribeOrganization. SSOCreateApplication allows sso:CreateApplication on arn:aws:sso:::instance/* and arn:aws:sso::aws:applicationProvider/mpa. SSOApplicationManagement allows six sso application actions (DescribeApplication, PutApplicationAssignmentConfiguration, PutApplicationGrant, PutApplicationAuthenticationMethod, PutApplicationAccessScope, DeleteApplication) on "*" with a StringEqualsIfExists condition on aws:CalledViaLast (mpa.amazonaws.com). SSOManagementAccess allows six sso and sso-directory read actions. Two statements allow kms:Decrypt with conditions on kms:ViaService and encryption context. ### Use cases - Give administrators full access to Multi-party approval, including setting up approval teams and the IAM Identity Center identity source they rely on. ### Prerequisites None. ### Best practices - The Multi-party approval User Guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - mpa:* on Resource "*" allows every Multi-party approval action, not only reads. - It can create and delete IAM Identity Center applications (sso:CreateApplication, sso:DeleteApplication) and change their grants, authentication methods and access scopes. The write actions other than sso:CreateApplication are on "*" with a StringEqualsIfExists condition on aws:CalledViaLast, so check how that condition behaves for your use. - It includes kms:Decrypt for IAM Identity Center and identity store encryption, limited by kms:ViaService and encryption context conditions. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Multi-party approval is intended. ### FAQs **When should I attach MultiPartyApprovalFullAccess?** The reference page says you can attach MultiPartyApprovalFullAccess to your users, groups and roles, and describes it as: provides full access to Multi-party approval and related permissions for approval teams and identity sources. Attach it where administering Multi-party approval is the intended scope. **What does MultiPartyApprovalFullAccess grant?** It allows mpa:* on all resources, two AWS Organizations read actions, IAM Identity Center application actions (create, describe, delete, grants, authentication methods and access scopes), sso and sso-directory read actions, and kms:Decrypt under IAM Identity Center and identity store conditions. **What are the security risks of MultiPartyApprovalFullAccess?** mpa:* allows every Multi-party approval action, and the policy includes IAM Identity Center application create and delete actions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [MultiPartyApprovalFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/MultiPartyApprovalFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for Multi-party approval](https://docs.aws.amazon.com/mpa/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## MultiPartyApprovalReadOnlyAccess - Page: https://iampolicymap.com/policies/multipartyapprovalreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v6. Guide reviewed against: v6. - Tier: operator. Distinct granted actions: 21 control plane, 0 data plane, 3 unclassified. - AWS description: Provides read-only access to Multi-party approval. This policy also includes related read permission to AWS Organizations and AWS IAM Identity for approval teams and identity sources. - Actions: https://iampolicymap.com/policies/multipartyapprovalreadonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary Provides read-only access to Multi-party approval, plus related read permissions to AWS Organizations and AWS IAM Identity Center for approval teams and identity sources. ### Practical scope 5 statements, all Allow. MpaReadAccess allows mpa:Get* and mpa:List* on Resource "*". OrganizationsAccess allows organizations:ListDelegatedAdministrators and organizations:DescribeOrganization. SSOManagementAccess allows sso:DescribeInstance, sso:ListInstances, sso:DescribeRegisteredRegions, sso:GetSharedSsoConfiguration, sso-directory:DescribeUsers and sso-directory:SearchUsers. Two statements allow kms:Decrypt with conditions on kms:ViaService and encryption context. ### Use cases - Give users or roles read-only access to Multi-party approval and the related organization and IAM Identity Center information. ### Prerequisites None. ### Best practices - The Multi-party approval User Guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - It includes kms:Decrypt (conditioned on kms:ViaService and the IAM Identity Center instance or identity store ARN encryption context), so it is more than metadata reads. - sso-directory:SearchUsers and sso-directory:DescribeUsers let principals look up users in the IAM Identity Center directory. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only access to Multi-party approval is intended. ### FAQs **When should I attach MultiPartyApprovalReadOnlyAccess?** The reference page says you can attach MultiPartyApprovalReadOnlyAccess to your users, groups and roles, and describes it as: provides read-only access to Multi-party approval and related read permissions to AWS Organizations and AWS IAM Identity Center. Attach it where viewing Multi-party approval is the intended scope. **What does MultiPartyApprovalReadOnlyAccess grant?** It allows mpa:Get* and mpa:List*, two AWS Organizations read actions, four sso read actions, sso-directory:DescribeUsers and sso-directory:SearchUsers on all resources, and kms:Decrypt under IAM Identity Center and identity store conditions. **What are the security risks of MultiPartyApprovalReadOnlyAccess?** It has no mpa write actions, but it can search IAM Identity Center directory users and includes kms:Decrypt under conditions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [MultiPartyApprovalReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/MultiPartyApprovalReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for Multi-party approval](https://docs.aws.amazon.com/mpa/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## NeptuneReadOnlyAccess - Page: https://iampolicymap.com/policies/neptunereadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/NeptuneReadOnlyAccess` - Kind: standard. Domain: databases. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 50 control plane, 2 data plane, 16 unclassified. - AWS description: Provides read only access to Amazon Neptune. Note that this policy also grants access to Amazon RDS resources. For more information, see https://aws.amazon.com/neptune/faqs/. - Actions: https://iampolicymap.com/policies/neptunereadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides read only access to Amazon Neptune. AWS notes that the policy also grants access to Amazon RDS resources. ### Practical scope Statements allow, on Resource "*", 21 read-style rds actions (for example rds:DescribeDBClusters, rds:DescribeDBInstances, rds:DownloadDBLogFilePortion and rds:ListTagsForResource), cloudwatch:GetMetricStatistics and cloudwatch:ListMetrics, seven ec2 Describe actions, kms:ListKeys, kms:ListRetirableGrants, kms:ListAliases and kms:ListKeyPolicies, and neptune-db:Read*, neptune-db:Get* and neptune-db:List*. logs:DescribeLogStreams and logs:GetLogEvents are limited to log streams in log groups under /aws/rds/ and /aws/neptune/. ### Use cases - View Neptune cluster configurations and query data without making changes, as the Neptune User Guide describes it. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy includes neptune-db:Read*, neptune-db:Get* and neptune-db:List* on all resources, which the Neptune User Guide calls read-only data-access actions. - AWS notes that the policy also grants access to Amazon RDS resources, so the rds read actions are not limited to Neptune clusters. - The policy includes rds:DownloadDBLogFilePortion and logs:GetLogEvents, which read database log content. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits users who need to view Neptune cluster configurations and query data without making changes. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach NeptuneReadOnlyAccess?** The Neptune User Guide says to use it for users who need to view cluster configurations and query data without making changes. You can attach it to users, groups and roles. **What does NeptuneReadOnlyAccess grant?** It allows read-style rds actions, CloudWatch metric reads, EC2 describe actions, KMS list actions and log stream reads on RDS and Neptune log groups, plus neptune-db:Read*, neptune-db:Get* and neptune-db:List* on all resources. **What are the security risks of NeptuneReadOnlyAccess?** It grants data access through neptune-db and rds log reads as well as configuration reads. AWS notes it also grants access to Amazon RDS resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [NeptuneReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/NeptuneReadOnlyAccess.md), retrieved 2026-11-13 - [Using AWS managed policies to access Amazon Neptune databases (Amazon Neptune User Guide)](https://docs.aws.amazon.com/neptune/latest/userguide/security-iam-access-managed-policies.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## NetworkAdministrator - Page: https://iampolicymap.com/policies/networkadministrator/ - ARN: `arn:aws:iam::aws:policy/job-function/NetworkAdministrator` - Kind: job-function. Domain: job-functions. Default version: v16. Guide reviewed against: v16. - Tier: admin. Distinct granted actions: 625 control plane, 2 data plane, 27 unclassified. - AWS description: Grants full access permissions to AWS services and actions required to set up and configure AWS network resources. - Actions: https://iampolicymap.com/policies/networkadministrator/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: directconnect (48 of 48), elasticloadbalancing (51 of 51), networkmanager (56 of 56), route53 (32 of 32), route53domains (22 of 22). - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). ### Summary A job function policy that grants full access permissions to AWS services and actions required to set up and configure AWS network resources. ### Practical scope The IAM User Guide says the policy grants permissions to create and maintain network resources in Auto Scaling, Amazon EC2, AWS Direct Connect, Route 53, Amazon CloudFront, Elastic Load Balancing, AWS Elastic Beanstalk, Amazon SNS, CloudWatch, CloudWatch Logs, Amazon S3, IAM and Amazon VPC. The policy document allows directconnect:*, elasticloadbalancing:*, route53:*, route53domains:* and networkmanager:* in full. For IAM it allows iam:GetRole, iam:ListRoles and iam:PassRole only on roles whose names match flow-logs-*, and iam:CreateServiceLinkedRole only when iam:AWSServiceName matches transitgateway.amazonaws.com. ### Use cases - The Network administrator job function: a user tasked with setting up and maintaining AWS network resources. - Letting Amazon VPC create and manage logs in CloudWatch Logs on the user's behalf to monitor IP traffic going in and out of a VPC, through a service role named flow-logs-*. ### Prerequisites - The flow logs use case needs a role you create yourself. If your users need the optional service role, you must create a role that follows the naming convention in the policy (flow-logs-*) and grant permissions to that role. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions. ### Security considerations - The policy grants iam:PassRole, which allows a user to pass a role to an AWS service. In this policy it is limited to roles matching flow-logs-*. - Most statements apply to Resource "*", including delete actions such as ec2:DeleteVpc, ec2:DeleteSecurityGroup and ec2:DeleteVolume, and rule changes such as ec2:AuthorizeSecurityGroupIngress. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. ### FAQs **When should I attach NetworkAdministrator?** Attach it to a user who is tasked with setting up and maintaining AWS network resources. It is the Network administrator job function, which AWS designed to align with a common job function in the IT industry. **What does NetworkAdministrator grant?** It grants permissions to create and maintain network resources across Auto Scaling, Amazon EC2, AWS Direct Connect, Route 53, Amazon CloudFront, Elastic Load Balancing, AWS Elastic Beanstalk, Amazon SNS, CloudWatch, CloudWatch Logs, Amazon S3, IAM and Amazon VPC. It allows directconnect:*, elasticloadbalancing:*, route53:*, route53domains:* and networkmanager:* in full. **What are the security risks of NetworkAdministrator?** Most of its statements apply to all resources and include create, modify and delete actions for network resources. It allows iam:PassRole, limited to roles named flow-logs-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [NetworkAdministrator (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/NetworkAdministrator.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## PowerUserAccess - Page: https://iampolicymap.com/policies/poweruseraccess/ - ARN: `arn:aws:iam::aws:policy/PowerUserAccess` - Kind: standard. Domain: privileged. Default version: v12. Guide reviewed against: v12. - Tier: admin; High privilege. Distinct granted actions: 21781 control plane, 483 data plane, 4470 unclassified. - AWS description: Provides full access to AWS services and resources, but does not allow management of Users and groups. - Actions: https://iampolicymap.com/policies/poweruseraccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: a4b (61 of 61), access-analyzer (15 of 15), acm (20 of 20), acm-pca (12 of 12), aco-automation (8 of 8), agent-registry (10 of 10), agentaccess-mcp (21 of 21), aidevops (45 of 45), aiops (15 of 15), and 354 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants permissions-management actions on sso on all resources without conditions. - 215 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary Provides full access to AWS services and resources, but does not allow management of Users and groups. The first statement allows everything except iam:*, organizations:* and account:* (using NotAction); a second statement adds back a short list of IAM, Organizations and Account actions. ### Practical scope The first statement uses NotAction to allow all actions for all AWS services and for all resources except AWS Identity and Access Management, AWS Organizations and AWS Account Management. The second statement grants IAM permissions to create a service-linked role, which some services need to access resources in another service. It also grants Organizations permissions to view information about the user's organisation, and Account Management permissions to view which AWS Regions are enabled or disabled. ### Use cases - The Developer power user job function: a user who performs application development tasks and can create and configure resources and services that support AWS aware application development. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - Although the policy limits IAM and AWS Organizations, it allows the user to perform all IAM Identity Center actions if IAM Identity Center is enabled. - Every service outside iam:*, organizations:* and account:* is allowed on all resources, because the first statement pairs NotAction with Resource "*". - The second statement allows iam:CreateServiceLinkedRole and iam:DeleteServiceLinkedRole on all resources. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide points to it for power users who need full access to every service except limited access to IAM and AWS Organizations. ### FAQs **When should I attach PowerUserAccess?** The IAM User Guide points to it for power users who need full access to every service except limited access to IAM and AWS Organizations. It is the Developer power user job function, for a user who performs application development tasks and can create and configure resources and services that support AWS aware application development. **What does PowerUserAccess grant?** Its first statement allows all actions on all resources except iam:*, organizations:* and account:*. Its second statement allows a short list of actions: account:GetAccountInformation, account:ListRegions, iam:CreateServiceLinkedRole, iam:DeleteServiceLinkedRole, iam:ListRoles, organizations:DescribeEffectivePolicy and organizations:DescribeOrganization, among others listed in the policy document. **What are the security risks of PowerUserAccess?** It allows all actions on all resources for every service outside IAM, AWS Organizations and Account Management, and it allows all IAM Identity Center actions if IAM Identity Center is enabled. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [PowerUserAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/PowerUserAccess.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## ReadOnlyAccess - Page: https://iampolicymap.com/policies/readonlyaccess/ - ARN: `arn:aws:iam::aws:policy/ReadOnlyAccess` - Kind: standard. Domain: security-identity-compliance. Default version: v191. Guide reviewed against: v191. - Tier: operator. Distinct granted actions: 6929 control plane, 147 data plane, 891 unclassified. - AWS description: Provides read-only access to AWS services and resources. - Actions: https://iampolicymap.com/policies/readonlyaccess/actions.json ### Tier reasons - Grants 9 write, tagging or permissions-management actions, short of full control of any service. - 1 granted write or permissions-management action has no data-plane classification from AWS, so the data-plane rule cannot assess it. - Can read secret values or decrypt data. Reads are not a High privilege rule. ### Summary AWS describes ReadOnlyAccess as providing read-only access to AWS services and resources. The IAM User Guide says it grants permissions to list, get, describe and otherwise view resources and their attributes, and that it does not include mutating functions like create or delete. The document names actions under 318 service prefixes, so it does not cover every AWS service, and it contains actions that go beyond plain reads (see practical scope). ### Practical scope Every statement applies to Resource "*"; the last statement also requires s3express:SessionMode to equal ReadOnly for s3express:CreateSession. Beyond list, get and describe actions, the document contains actions such as s3express:CreateSession (conditioned on s3express:SessionMode being ReadOnly), devops-guru:StartCostEstimation, servicequotas:StartQuotaUtilizationReport, xray:StartTraceRetrieval and sqs:Receive*, and data-reading actions such as s3:Get*, s3:List*, dynamodb:Query, dynamodb:Scan, sqs:Receive*, logs:FilterLogEvents, logs:StartQuery and iam:Simulate*. AWS says it includes read-only access to security-related AWS services, such as AWS Identity and Access Management and AWS Billing and Cost Management. ### Use cases - Give a user read-only access to every resource in an AWS account (the Read-only access job function). - Keep read access in step with new services: AWS says it updates ReadOnlyAccess to add read-only permissions when it launches a new service. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - If you need a similar policy that doesn't grant access to read data in storage services, AWS points to the View-only user job function (ViewOnlyAccess). ### Security considerations - AWS notes that this user will also have access to read data in storage services like Amazon S3 buckets and Amazon DynamoDB tables. The policy document allows s3:Get*, dynamodb:Query and dynamodb:Scan on all resources. - The policy includes read-only access to security-related AWS services, such as AWS Identity and Access Management and AWS Billing and Cost Management. - AWS updates ReadOnlyAccess to add read-only permissions when it launches a new service, and the updated permissions apply to every identity the policy is attached to. You cannot change the permissions in an AWS managed policy. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide lists it with the job function policies, and AWS says you can attach those to any IAM identity. It fits where read access to everything in the account, including stored data, is intended. ### FAQs **When should I attach ReadOnlyAccess?** Attach it for a user who requires read-only access to every resource in an AWS account. Because it also reads data in storage services, use ViewOnlyAccess instead if that is more than the user needs. **What does ReadOnlyAccess grant?** AWS describes it as providing read-only access to AWS services and resources: permissions to list, get, describe and otherwise view resources and their attributes, without mutating functions like create or delete. The document names actions under 318 service prefixes and includes actions such as s3:Get*, s3:List*, dynamodb:Query, dynamodb:Scan, sqs:Receive* and iam:Simulate*, all on Resource "*". **What are the security risks of ReadOnlyAccess?** The user can read data in storage services such as Amazon S3 buckets and Amazon DynamoDB tables, and gets read-only access to security-related services such as IAM and AWS Billing and Cost Management. AWS adds read-only permissions for new services to this policy and the change reaches every identity it is attached to. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ReadOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## ResourceGroupsandTagEditorFullAccess - Page: https://iampolicymap.com/policies/resourcegroupsandtageditorfullaccess/ - ARN: `arn:aws:iam::aws:policy/ResourceGroupsandTagEditorFullAccess` - Kind: standard. Domain: management-governance. Default version: v6. Guide reviewed against: v6. - Tier: admin. Distinct granted actions: 37 control plane, 0 data plane, 6 unclassified. - AWS description: Provides full access to Resource Groups and Tag Editor. - Actions: https://iampolicymap.com/policies/resourcegroupsandtageditorfullaccess/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: resource-groups (14 of 14). ### Summary Provides full access to Resource Groups and Tag Editor. The Resource Groups User Guide says it grants the permissions required for full access to Resource Groups and Tag Editor functionality. ### Practical scope One statement with 9 entries, all on Resource "*": tag:getResources, tag:getTagKeys, tag:getTagValues, tag:TagResources, tag:UntagResources, resource-groups:*, cloudformation:DescribeStacks, cloudformation:ListStackResources and cloudformation:ListStacks. ### Use cases - Give users or roles full access to Resource Groups and Tag Editor, including tag:TagResources and tag:UntagResources. ### Prerequisites None. ### Best practices - The AWS Resource Groups User Guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - tag:TagResources and tag:UntagResources on Resource "*" let principals add and remove tags on resources, and resource-groups:* allows every Resource Groups action. - It also reads CloudFormation stack and stack resource information (cloudformation:DescribeStacks, cloudformation:ListStackResources, cloudformation:ListStacks). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access to Resource Groups and Tag Editor is intended. ### FAQs **When should I attach ResourceGroupsandTagEditorFullAccess?** The reference page says you can attach ResourceGroupsandTagEditorFullAccess to your users, groups and roles, and describes it as: provides full access to Resource Groups and Tag Editor. Attach it where managing resource groups and tags is the intended scope. **What does ResourceGroupsandTagEditorFullAccess grant?** It allows tag:getResources, tag:getTagKeys, tag:getTagValues, tag:TagResources and tag:UntagResources, resource-groups:*, and three read actions on CloudFormation stacks, all on all resources. **What are the security risks of ResourceGroupsandTagEditorFullAccess?** tag:TagResources, tag:UntagResources and resource-groups:* are write-capable on all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ResourceGroupsandTagEditorFullAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ResourceGroupsandTagEditorFullAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Resource Groups](https://docs.aws.amazon.com/ARG/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## ResourceGroupsandTagEditorReadOnlyAccess - Page: https://iampolicymap.com/policies/resourcegroupsandtageditorreadonlyaccess/ - ARN: `arn:aws:iam::aws:policy/ResourceGroupsandTagEditorReadOnlyAccess` - Kind: standard. Domain: management-governance. Default version: v3. Guide reviewed against: v3. - Tier: reader. Distinct granted actions: 19 control plane, 0 data plane, 2 unclassified. - AWS description: Provides access to use Resource Groups and Tag Editor, but does not allow editing of tags via the Tag Editor. - Actions: https://iampolicymap.com/policies/resourcegroupsandtageditorreadonlyaccess/actions.json ### Tier reasons - Grants only List and Read actions. ### Summary Provides access to use Resource Groups and Tag Editor, but does not allow editing of tags via the Tag Editor. The Resource Groups User Guide says it grants the permissions required for read only access to Resource Groups and Tag Editor functionality. ### Practical scope One statement with 9 entries, all on Resource "*": tag:getResources, tag:getTagKeys, tag:getTagValues, resource-groups:Get*, resource-groups:List*, resource-groups:Search*, cloudformation:DescribeStacks, cloudformation:ListStackResources and cloudformation:ListStacks. ### Use cases - Give users or roles read access to Resource Groups and Tag Editor, to find resources by tag and view groups. ### Prerequisites None. ### Best practices - The AWS Resource Groups User Guide says AWS managed policies might not grant least-privilege permissions for your specific use cases and recommends reducing permissions further with customer managed policies specific to your use cases. ### Security considerations - It has no tag:TagResources or tag:UntagResources, but it applies to all resources, so principals can find resources across services by tag through tag:getResources. - It also reads CloudFormation stack and stack resource information (cloudformation:DescribeStacks, cloudformation:ListStackResources, cloudformation:ListStacks). - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read-only use of Resource Groups and Tag Editor is intended. ### FAQs **When should I attach ResourceGroupsandTagEditorReadOnlyAccess?** The reference page says you can attach ResourceGroupsandTagEditorReadOnlyAccess to your users, groups and roles, and describes it as: provides access to use Resource Groups and Tag Editor, but does not allow editing of tags via the Tag Editor. Attach it where viewing resource groups and tags is the intended scope. **What does ResourceGroupsandTagEditorReadOnlyAccess grant?** It allows tag:getResources, tag:getTagKeys and tag:getTagValues, resource-groups:Get*, List* and Search*, and three read actions on CloudFormation stacks, all on all resources. **What are the security risks of ResourceGroupsandTagEditorReadOnlyAccess?** It does not allow tagging or untagging, but it applies to all resources and the resource-groups wildcards cover every Get, List and Search action. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ResourceGroupsandTagEditorReadOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ResourceGroupsandTagEditorReadOnlyAccess.md), retrieved 2026-11-13 - [AWS managed policies for AWS Resource Groups](https://docs.aws.amazon.com/ARG/latest/userguide/security-iam-awsmanpol.md), retrieved 2026-11-13 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 ## SageMakerStudioAdminIAMPermissiveExecutionPolicy - Page: https://iampolicymap.com/policies/sagemakerstudioadminiampermissiveexecutionpolicy/ - ARN: `arn:aws:iam::aws:policy/SageMakerStudioAdminIAMPermissiveExecutionPolicy` - Kind: standard. Domain: privileged. Default version: v25. Guide reviewed against: v25. - Tier: admin; High privilege. Distinct granted actions: 4043 control plane, 169 data plane, 715 unclassified. - AWS description: Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch L… - Actions: https://iampolicymap.com/policies/sagemakerstudioadminiampermissiveexecutionpolicy/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: airflow (8 of 8), airflow-serverless (5 of 5), application-autoscaling (6 of 6), athena (36 of 36), bedrock (136 of 136), bedrock-agentcore (148 of 148), cloudwatch (89 of 89), codeconnections (13 of 13), and 24 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - Grants permissions-management actions on iam, but only for scoped resources or under conditions. - 31 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary An administrative execution policy for using IAM roles with SageMaker Unified Studio. The SageMaker Unified Studio Administrator Guide says it grants administrative access to provision, manage and access resources in your account, including broad access to data resources. ### Practical scope The DataAccess and ComputeAccess statements allow service-wide wildcards on Resource "*", including s3:*, glue:*, logs:*, redshift:*, redshift-data:*, rds:*, athena:*, bedrock:*, sagemaker:*, datazone:*, elasticmapreduce:* and airflow:*. iam:GetRole, iam:ListRoles, iam:GetUser, iam:ListUsers, sts:AssumeRole and sts:GetServiceBearerToken are allowed on all resources. iam:CreateRole and iam:AttachRolePolicy are limited to roles under service-role/AmazonSageMaker*, and attached policies are limited to listed policy ARNs. iam:UpdateAssumeRolePolicy is limited to AmazonSageMaker Admin and User IAM execution role names. iam:PassRole on all resources requires the target service to be one of a listed set (including sagemaker.amazonaws.com, lakeformation.amazonaws.com, athena.amazonaws.com, glue.amazonaws.com, datazone.amazonaws.com and airflow-serverless.amazonaws.com) and the resource to be in the same account. A second iam:PassRole statement covers roles under service-role/AmazonSageMaker* and a role path taken from a principal tag, for a listed set of services. Lake Formation, Secrets Manager, KMS, DynamoDB, ECR and SSM actions also appear. Deny statements apply to athena, emr-serverless, emr-containers, elasticmapreduce and glue session resources when the AmazonDataZoneSessionOwner tag does not match the source identity. ### Use cases - Provision, manage and access resources for SageMaker Unified Studio when using IAM roles. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The guide says it grants broad access to data resources and full access to all APIs and resources for services used in SageMaker Unified Studio, such as S3, AWS Glue, Amazon Redshift, Athena, Amazon Bedrock and CloudWatch Logs. - The IAM actions allow creating roles under service-role/AmazonSageMaker*, attaching listed policies to them, and updating the trust policy of the SageMaker Unified Studio execution roles. iam:PassRole is limited to listed services. The IAM User Guide says a user must have permission to pass a role to an AWS service before the service can be configured with that role. - The Deny statements apply only to session resources, under a condition on the AmazonDataZoneSessionOwner tag. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The SageMaker Unified Studio Administrator Guide describes it as an administrative execution policy for using IAM roles with SageMaker Unified Studio. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach SageMakerStudioAdminIAMPermissiveExecutionPolicy?** The SageMaker Unified Studio Administrator Guide describes it as an administrative execution policy for using IAM roles with SageMaker Unified Studio. Attach it only where administrators need to provision, manage and access resources through that service. **What does SageMakerStudioAdminIAMPermissiveExecutionPolicy grant?** It allows service-wide actions on all resources for the data and compute services Unified Studio uses (including S3, Glue, Redshift, Athena, Bedrock, SageMaker, DataZone and EMR), plus scoped IAM actions to create execution roles and update their trust policy, conditioned iam:PassRole, and Lake Formation, Secrets Manager, KMS, DynamoDB, ECR and SSM actions. **What are the security risks of SageMakerStudioAdminIAMPermissiveExecutionPolicy?** AWS says the policy gives broad access to data resources and full access to all APIs of the services it covers. It also allows role creation, policy attachment and trust policy updates within the AmazonSageMaker role patterns. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [SageMakerStudioAdminIAMPermissiveExecutionPolicy (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SageMakerStudioAdminIAMPermissiveExecutionPolicy.md), retrieved 2026-11-13 - [AWS policy: SageMakerStudioAdminIAMPermissiveExecutionPolicy (Amazon SageMaker Unified Studio Administrator Guide)](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMPermissiveExecutionPolicy.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## SageMakerStudioUserIAMPermissiveExecutionPolicy - Page: https://iampolicymap.com/policies/sagemakerstudiouseriampermissiveexecutionpolicy/ - ARN: `arn:aws:iam::aws:policy/SageMakerStudioUserIAMPermissiveExecutionPolicy` - Kind: standard. Domain: privileged. Default version: v27. Guide reviewed against: v27. - Tier: admin; High privilege. Distinct granted actions: 3827 control plane, 169 data plane, 673 unclassified. - AWS description: Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in your account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of Sag… - Actions: https://iampolicymap.com/policies/sagemakerstudiouseriampermissiveexecutionpolicy/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: airflow (8 of 8), airflow-serverless (5 of 5), application-autoscaling (6 of 6), athena (36 of 36), bedrock (136 of 136), bedrock-agentcore (148 of 148), cloudwatch (89 of 89), codewhisperer (9 of 9), and 21 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 31 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary An execution policy for using IAM roles with Amazon SageMaker Unified Studio. The SageMaker Unified Studio Administrator Guide says it grants users access to resources in your account, including broad access to data resources. ### Practical scope The DataAccess and ComputeAccess statements allow service-wide wildcards on Resource "*", including s3:*, glue:*, logs:*, redshift:*, redshift-data:*, rds:*, athena:*, bedrock:*, sagemaker:*, elasticmapreduce:* and airflow:*. A DataZone statement allows 62 datazone actions, including datazone:Get*, datazone:List*, datazone:CreateAsset* and datazone:DeleteAsset*. iam:GetRole, iam:ListRoles, sts:AssumeRole and sts:GetServiceBearerToken are allowed on all resources. iam:PassRole is limited to roles under service-role/AmazonSageMaker* and to a listed set of target services. Lake Formation, Secrets Manager, KMS, DynamoDB, ECR, EC2 VPC, IAM Identity Center read and identity store read actions also appear. Deny statements apply to athena, emr-serverless, emr-containers, elasticmapreduce and glue session resources when the AmazonDataZoneSessionOwner tag does not match the source identity. ### Use cases - Access the resources of SageMaker Unified Studio, including data and compute services, when using IAM roles. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The guide says it provides full access to all APIs and resources for services used in SageMaker Unified Studio, such as S3, AWS Glue, Amazon Redshift, Athena, Amazon Bedrock and CloudWatch Logs. - iam:PassRole is limited to roles under service-role/AmazonSageMaker* and listed target services. The IAM User Guide says a user must have permission to pass a role to an AWS service before the service can be configured with that role. sts:AssumeRole is allowed on all resources, which the guide says is for accessing cross-account resources. - The Deny statements apply only to session resources, under a condition on the AmazonDataZoneSessionOwner tag. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The SageMaker Unified Studio Administrator Guide describes it as an execution policy for using IAM roles with SageMaker Unified Studio. Where a narrower scope is needed, AWS recommends customer managed policies specific to your use cases. ### FAQs **When should I attach SageMakerStudioUserIAMPermissiveExecutionPolicy?** The SageMaker Unified Studio Administrator Guide describes it as an execution policy for using IAM roles with SageMaker Unified Studio, granting users access to resources in your account. Attach it where users need that access through the service. **What does SageMakerStudioUserIAMPermissiveExecutionPolicy grant?** It allows service-wide actions on all resources for the data and compute services Unified Studio uses (including S3, Glue, Redshift, Athena, Bedrock, SageMaker and EMR), DataZone actions, role assumption, conditioned iam:PassRole, and Lake Formation, Secrets Manager, KMS, DynamoDB and ECR actions. **What are the security risks of SageMakerStudioUserIAMPermissiveExecutionPolicy?** AWS says the policy gives broad access to data resources and full access to all APIs of the services it covers. sts:AssumeRole is allowed on all resources. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to. ### Sources - [SageMakerStudioUserIAMPermissiveExecutionPolicy (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SageMakerStudioUserIAMPermissiveExecutionPolicy.md), retrieved 2026-11-13 - [AWS policy: SageMakerStudioUserIAMPermissiveExecutionPolicy (Amazon SageMaker Unified Studio Administrator Guide)](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMPermissiveExecutionPolicy.md), retrieved 2026-11-13 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 - [Grant a user permissions to pass a role to an AWS service (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.md), retrieved 2026-11-13 ## SecurityAudit - Page: https://iampolicymap.com/policies/securityaudit/ - ARN: `arn:aws:iam::aws:policy/SecurityAudit` - Kind: standard. Domain: security-identity-compliance. Default version: v94. Guide reviewed against: v94. - Tier: operator. Distinct granted actions: 3095 control plane, 29 data plane, 237 unclassified. - AWS description: The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account. - Actions: https://iampolicymap.com/policies/securityaudit/actions.json ### Tier reasons - Grants 4 write, tagging or permissions-management actions, short of full control of any service. ### Summary The security audit template grants access to read security configuration metadata. It is useful for software that audits the configuration of an AWS account. The IAM User Guide says it grants permissions to view configuration data for many AWS services and to review their logs. ### Practical scope The BaseSecurityAuditStatement statement applies to Resource "*". A second statement, APIGatewayAccess, allows apigateway:GET on a list of Amazon API Gateway resource ARNs. Alongside list, get and describe actions the document includes iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:SimulatePrincipalPolicy, rds:DownloadDBLogFilePortion and codedeploy:Batch*. ### Use cases - Monitor an account for compliance with security requirements, and access logs and events to investigate potential security breaches or potential malicious activity (the Security auditor job function). - Give software that audits the configuration of an AWS account access to read security configuration metadata. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The main statement applies to all resources. Besides read-style actions it includes iam:SimulatePrincipalPolicy and rds:DownloadDBLogFilePortion, so review the full document before giving it to a person or tool. - The document allows cloudtrail:LookupEvents, logs:Describe*, logs:GetLogDelivery and logs:ListLogDeliveries. It does not include logs:GetLogEvents, logs:FilterLogEvents or logs:StartQuery. It names actions under 198 service prefixes. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits a security auditor or an auditing tool that needs to read configuration data across services. ### FAQs **When should I attach SecurityAudit?** Attach it for a user who monitors accounts for compliance with security requirements, or for software that audits the configuration of an AWS account. It is the Security auditor job function. **What does SecurityAudit grant?** It grants access to read security configuration metadata: permissions to view configuration data for many AWS services and to review their logs, on all resources, plus apigateway:GET on a list of Amazon API Gateway resource ARNs. **What are the security risks of SecurityAudit?** The policy applies to all resources and includes actions such as iam:SimulatePrincipalPolicy and rds:DownloadDBLogFilePortion as well as read-style actions. Among log-related actions it allows cloudtrail:LookupEvents, logs:Describe*, logs:GetLogDelivery and logs:ListLogDeliveries, but not logs:GetLogEvents, logs:FilterLogEvents or logs:StartQuery. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [SecurityAudit (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## SupportUser - Page: https://iampolicymap.com/policies/supportuser/ - ARN: `arn:aws:iam::aws:policy/job-function/SupportUser` - Kind: job-function. Domain: job-functions. Default version: v12. Guide reviewed against: v12. - Tier: admin. Distinct granted actions: 1847 control plane, 18 data plane, 192 unclassified. - AWS description: This policy grants permissions to troubleshoot and resolve issues in an AWS account. This policy also enables the user to contact AWS support to create and manage cases. - Actions: https://iampolicymap.com/policies/supportuser/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: support (17 of 17). ### Summary A job function policy that grants permissions to troubleshoot and resolve issues in an AWS account. It also enables the user to contact AWS Support to create and manage cases. ### Practical scope The policy is a single statement on Resource "*". It allows support:* and support-console actions, plus read-style actions across many services, for example ec2:Describe*, cloudwatch:Get*, iam:Get*, iam:List*, kms:Get*, s3:List* and rds:Describe*. A few actions are not plain reads, for example iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, sqs:ReceiveMessage and codepipeline:PollForJobs. ### Use cases - Troubleshoot and resolve issues in an AWS account. - Contact AWS Support to create and manage cases. ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The policy applies to Resource "*" and combines support:* with read access across many services, including iam:Get*, iam:List*, kms:Get* and sqs:ReceiveMessage. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. The cached IAM User Guide job function page names AWSSupportAccess, not SupportUser, as its support user policy, so check which of the two you intend. ### FAQs **When should I attach SupportUser?** Attach it to a user who needs to troubleshoot and resolve issues in an AWS account and to contact AWS Support to create and manage cases. The IAM User Guide job function page lists AWSSupportAccess for the Support user job function, so compare the two before you choose. **What does SupportUser grant?** It allows support:* and support-console actions plus read-style actions across many services, such as ec2:Describe*, cloudwatch:Get*, iam:Get*, iam:List* and s3:List*, on all resources. **What are the security risks of SupportUser?** The policy combines full Support access with read access across many services on all resources, including IAM, AWS KMS and Amazon SQS actions such as sqs:ReceiveMessage. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [SupportUser (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SupportUser.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## SystemAdministrator - Page: https://iampolicymap.com/policies/systemadministrator/ - ARN: `arn:aws:iam::aws:policy/job-function/SystemAdministrator` - Kind: job-function. Domain: job-functions. Default version: v12. Guide reviewed against: v12. - Tier: admin; High privilege. Distinct granted actions: 2167 control plane, 41 data plane, 206 unclassified. - AWS description: Grants full access permissions necessary for resources required for application and development operations. - Actions: https://iampolicymap.com/policies/systemadministrator/actions.json ### Tier reasons - Grants at least 80% of the write and permissions-management actions of: autoscaling (43 of 43), cloudwatch (89 of 89), codedeploy (19 of 19), codepipeline (27 of 27), config (42 of 42), ds (60 of 60), elasticloadbalancing (51 of 51), events (45 of 45), logs (70 of 70), and 7 more. - Grants data-plane write actions on a data store on all resources without conditions. - Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService). - 18 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them. ### Summary A job function policy that grants full access permissions necessary for resources required for application and development operations. ### Practical scope AWS says the policy grants permissions to create and maintain resources across a large variety of AWS services, including AWS CloudTrail, Amazon CloudWatch, AWS CodeCommit, AWS CodeDeploy, AWS Config, AWS Directory Service, Amazon EC2, AWS Identity and Access Management, AWS Key Management Service, AWS Lambda, Amazon RDS, Route 53, Amazon S3, Amazon SES, Amazon SQS, AWS Trusted Advisor and Amazon VPC. The document allows autoscaling:*, cloudwatch:*, codedeploy:*, codepipeline:*, config:*, ds:*, elasticloadbalancing:*, events:*, logs:*, route53:*, route53domains:*, ses:*, sns:*, sqs:* and s3:* in full, on Resource "*". It allows iam:ListRoles and iam:GetRole* actions on Resource "*". Only iam:PassRole is limited, to roles named rds-monitoring-role, ec2-sysadmin-*, ecr-sysadmin-* and lambda-sysadmin-*. ### Use cases - The System administrator job function: a user who sets up and maintains resources for development operations. - Passing a role to a service through the named service roles: ecr-sysadmin-* for apps on EC2 instances in an Amazon ECS cluster, rds-monitoring-role to monitor databases, ec2-sysadmin-* for apps running on EC2 instances, and lambda-sysadmin-* to let Lambda read DynamoDB streams and write to CloudWatch Logs. ### Prerequisites - If your users need the optional service roles, you must create a role that follows the naming convention in the policy and grant permissions to that role. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. - The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions. ### Security considerations - Most statements apply to Resource "*" and include create, modify and delete actions, for example ec2:RunInstances, ec2:TerminateInstances, ec2:DeleteSecurityGroup, cloudtrail:StopLogging, kms:CreateKey and lambda:Delete*, as well as full access to Amazon S3 (s3:*). - The policy grants iam:PassRole, which allows a user to pass a role to an AWS service. In this policy it is limited to roles named rds-monitoring-role, ec2-sysadmin-*, ecr-sysadmin-* and lambda-sysadmin-*. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where one user needs to set up and maintain development operations resources across many services. ### FAQs **When should I attach SystemAdministrator?** Attach it to a user who sets up and maintains resources for development operations. It is the System administrator job function, which AWS designed to align with a common job function in the IT industry. **What does SystemAdministrator grant?** It grants permissions to create and maintain resources across services including AWS CloudTrail, Amazon CloudWatch, AWS CodeCommit, AWS CodeDeploy, AWS Config, AWS Directory Service, Amazon EC2, IAM, AWS KMS, AWS Lambda, Amazon RDS, Route 53, Amazon S3, Amazon SES, Amazon SQS, AWS Trusted Advisor and Amazon VPC. It allows s3:*, sns:*, sqs:* and logs:* in full. **What are the security risks of SystemAdministrator?** Most statements apply to all resources and include create, modify and delete actions, such as ec2:TerminateInstances and cloudtrail:StopLogging. It allows iam:PassRole, limited to roles named rds-monitoring-role, ec2-sysadmin-*, ecr-sysadmin-* and lambda-sysadmin-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [SystemAdministrator (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SystemAdministrator.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12 ## ViewOnlyAccess - Page: https://iampolicymap.com/policies/viewonlyaccess/ - ARN: `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess` - Kind: job-function. Domain: job-functions. Default version: v48. Guide reviewed against: v48. - Tier: operator. Distinct granted actions: 1990 control plane, 21 data plane, 159 unclassified. - AWS description: This policy grants permissions to view resources and basic metadata across all AWS services. - Actions: https://iampolicymap.com/policies/viewonlyaccess/actions.json ### Tier reasons - Grants 1 write, tagging or permissions-management action, short of full control of any service. ### Summary A job function policy that AWS describes as granting permissions to view resources and basic metadata across all AWS services. The IAM User Guide describes it as granting List*, Describe*, Get*, View* and Lookup* access to resources for AWS services. The document names actions under 125 service prefixes, so check that the services you use are covered. ### Practical scope The GeneralViewOnlyAccessStatement statement applies to Resource "*". A second statement, APIGatewayAccess, allows apigateway:GET on a list of Amazon API Gateway resource ARNs. AWS says the user can view a list of AWS resources and basic metadata in the account across services, but cannot read resource content or metadata that goes beyond the quota and list information for resources. ### Use cases - View a list of AWS resources and basic metadata in the account across services (the View-only user job function). ### Prerequisites None. ### Best practices - AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions. ### Security considerations - The first statement applies to all resources across services, so it exposes resource lists and basic metadata account-wide, even though AWS says it does not read resource content. - In the IAM User Guide, ReadOnlyAccess points to ViewOnlyAccess as the option that doesn't grant access to read data in storage services. - You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to. ### Assignment guidance You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where a user only needs to see what exists in the account. Where a user must read stored data, AWS describes ReadOnlyAccess instead. ### FAQs **When should I attach ViewOnlyAccess?** Attach it for a user who needs to view a list of AWS resources and basic metadata in the account across services. It is the View-only user job function. **What does ViewOnlyAccess grant?** It grants List*, Describe*, Get*, View* and Lookup* access to resources for AWS services, plus apigateway:GET on a list of Amazon API Gateway resource ARNs. **What are the security risks of ViewOnlyAccess?** It applies to all resources across services, so the user can see what exists throughout the account. AWS says the user cannot read resource content or metadata beyond quota and list information. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to. ### Sources - [ViewOnlyAccess (AWS Managed Policy Reference Guide)](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ViewOnlyAccess.md), retrieved 2026-11-12 - [AWS managed policies for job functions (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.md), retrieved 2026-11-12 - [Managed policies and inline policies (IAM User Guide)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.md), retrieved 2026-11-12