AIOpsConsoleAdminPolicy

Summary

Grants full access to Amazon AI Operations service and its required permissions via AWS console. It also includes permissions to use identity-aware console sessions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicyCopy ARN

Default version

v9

Created

2024-12-02

Last edited

2026-02-12

Services

aiops, chatbot, cloudtrail, iam, identitystore, kms, organizations, q, secretsmanager, signin, ssm, sso, sso-directory, sts, tag

Control-plane actions (80)

By access level: 15 List, 2 Permissions management, 26 Read, 4 Tagging, 33 Write.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: aiops (15 of 15).
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
• Grants permissions-management actions on iam, but only for scoped resources or under conditions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AIOpsAssistantIncidentReportPolicy
• AIOpsOperatorAccess
• AIOpsReadOnlyAccess
• AmazonBioDiscoveryFullAccess
• AmazonBioDiscoveryInAppFullAccess
• AmazonHoneycodeServiceRolePolicy
• AWSControlTowerIdentityCenterManagementPolicy
• AWSGrafanaWorkspacePermissionManagement

Same domain

• AgentRegistryFullAccess
• AgentRegistryReadOnlyAccess
• AIOpsAssistantPolicy
• AmazonAugmentedAIFullAccess
• AmazonAugmentedAIHumanLoopFullAccess
• AmazonAugmentedAIIntegratedAPIAccess
• AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy
• AmazonBedrockExternalWebSearchFullAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AIOpsAdmin",
      "Effect": "Allow",
      "Action": [
        "aiops:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSOApplicationManagement",
      "Effect": "Allow",
      "Action": [
        "sso:PutApplicationAccessScope",
        "sso:PutApplicationAssignmentConfiguration",
        "sso:PutApplicationGrant",
        "sso:PutApplicationAuthenticationMethod",
        "sso:DeleteApplication"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "aiops.amazonaws.com",
          "aws:ResourceTag/ManagedByAmazonAIOperations": "true"
        }
      }
    },
    {
      "Sid": "SSOApplicationTagManagement",
      "Effect": "Allow",
      "Action": [
        "sso:CreateApplication",
        "sso:TagResource"
      ],
      "Resource": [
        "arn:aws:sso:::instance/*",
        "arn:aws:sso::aws:applicationProvider/aiops"
      ],
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "aiops.amazonaws.com",
          "aws:RequestTag/ManagedByAmazonAIOperations": "true"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "ManagedByAmazonAIOperations"
          ]
        }
      }
    },
    {
      "Sid": "SSOTagManagement",
      "Effect": "Allow",
      "Action": [
        "sso:TagResource"
      ],
      "Resource": "arn:aws:sso::*:application/*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "aiops.amazonaws.com",
          "aws:ResourceTag/ManagedByAmazonAIOperations": "true"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "ManagedByAmazonAIOperations"
          ]
        }
      }
    },
    {
      "Sid": "SSOManagementAccess",
      "Effect": "Allow",
      "Action": [
        "identitystore:DescribeUser",
        "sso:ListApplications",
        "sso:ListInstances",
        "sso:DescribeRegisteredRegions",
        "sso:GetSharedSsoConfiguration",
        "sso:DescribeInstance",
        "sso:GetSSOStatus",
        "sso-directory:DescribeUsers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSTSContextSetting",
      "Effect": "Allow",
      "Action": [
        "sts:SetContext"
      ],
      "Resource": "arn:aws:sts::*:self"
    },
    {
      "Sid": "IdentityPropagationAccess",
      "Effect": "Allow",
      "Action": [
        "signin:ListTrustedIdentityPropagationApplicationsForConsole"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudtrailAccess",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:ListTrails",
        "cloudtrail:DescribeTrails",
        "cloudtrail:ListEventDataStores"
      ],
      "Resource": "*"
    },
    {
      "Sid": "KMSAccess",
      "Effect": "Allow",
      "Action": [
        "kms:ListAliases"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSMIntegrationSecretsManagerAccess",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DeleteSecret"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:aws/ssm/3p/*"
    },
    {
      "Sid": "SSMIntegrationAccess",
      "Effect": "Allow",
      "Action": [
        "ssm:GetServiceSetting",
        "ssm:UpdateServiceSetting"
      ],
      "Resource": "arn:aws:ssm:*:*:servicesetting/integrations/*"
    },
    {
      "Sid": "SSMIntegrationCreatePolicy",
      "Effect": "Allow",
      "Action": [
        "iam:CreatePolicy"
      ],
      "Resource": "arn:aws:iam::*:policy/service-role/AWSServiceRoleSSMIntegrationsPolicy*"
    },
    {
      "Sid": "ChatbotConfigurations",
      "Effect": "Allow",
      "Action": [
        "chatbot:DescribeChimeWebhookConfigurations",
        "chatbot:DescribeSlackWorkspaces",
        "chatbot:DescribeSlackChannelConfigurations",
        "chatbot:ListMicrosoftTeamsChannelConfigurations",
        "chatbot:ListMicrosoftTeamsConfiguredTeams"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IAMPassRoleToAIOps",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "aiops.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IAMListRoles",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TagBoundaryPermission",
      "Effect": "Allow",
      "Action": [
        "tag:GetTagKeys"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IAMPassRoleToSSMIntegration",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ssm.integrations.amazonaws.com"
        },
        "ArnEquals": {
          "iam:AssociatedResourceArn": "arn:aws:aiops:*:*:investigation-group/*"
        }
      }
    },
    {
      "Sid": "SSMOpsItemAccess",
      "Effect": "Allow",
      "Action": [
        "ssm:CreateOpsItem",
        "ssm:AddTagsToResource"
      ],
      "Resource": "arn:*:ssm:*:*:opsitem/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/Integration": "CloudWatch",
          "aws:ResourceTag/Integration": "CloudWatch"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "Integration"
          ]
        }
      }
    },
    {
      "Sid": "CreateAIOpsCrossAccountAssistantPolicy",
      "Effect": "Allow",
      "Action": [
        "iam:CreatePolicy"
      ],
      "Resource": "arn:aws:iam::*:policy/AIOpsCrossAccountAssistantPolicy*"
    },
    {
      "Sid": "AmazonQAccess",
      "Effect": "Allow",
      "Action": [
        "q:StartConversation",
        "q:SendMessage",
        "q:GetConversation",
        "q:ListConversations",
        "q:UpdateConversation",
        "q:DeleteConversation",
        "q:PassRequest"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v9, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy

resource "aws_iam_role_policy_attachment" "aiopsconsoleadminpolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AIOpsConsoleAdminPolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for AIOpsConsoleAdminPolicy
• Report a data issue