Skip to main content
IAM Policy Map

AmazonBioDiscoveryInAppFullAccess

OperatorAWS managedActiveReviewedShow on mapCompare

Summary

Provides full access to actions within the Amazon Bio Discovery applications.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess
Default version
v1
Created
Last edited
Services
identitystore, kms, researchstudio, sso

Control-plane actions (13)

By access level: 5 List, 1 Read, 7 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Identity Store3 of 293 List; 3 restricted, 0 conditionalidentitystore:ListGroupMembershipsForMember, identitystore:ListGroups, identitystore:ListUsers
KMS1 of 581 Write; 1 restricted, 1 conditionalkms:Decrypt
Bio DiscoveryAll 6 actions (see the Bio Discovery page)1 List, 1 Read, 4 Write; 0 restricted, 0 conditionalresearchstudio:*
IAM Identity Center3 of 1261 List, 2 Write; 3 restricted, 0 conditionalsso:CreateApplicationAssignment, sso:DeleteApplicationAssignment, sso:ListApplicationAssignments
Identity Store: 3 actions
  • identitystore:ListGroupMembershipsForMember (List)
  • identitystore:ListGroups (List)
  • identitystore:ListUsers (List)
KMS: 1 actions
  • kms:Decrypt (Write)
IAM Identity Center: 3 actions
  • sso:CreateApplicationAssignment (Write)
  • sso:DeleteApplicationAssignment (Write)
  • sso:ListApplicationAssignments (List)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants 7 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Practical scope

Five statements. AmazonBioDiscoveryInAppFullAccess allows researchstudio:* on Resource "*". AmazonBioDiscoveryIdentityStoreInAppAccess allows identitystore:ListGroupMembershipsForMember, identitystore:ListGroups and identitystore:ListUsers on identity store resources. AmazonBioDiscoveryIdentityCenterInAppAccess allows sso:CreateApplicationAssignment, sso:DeleteApplicationAssignment and sso:ListApplicationAssignments on IAM Identity Center instances and applications. Two statements allow kms:Decrypt on all keys only when the call is made via sso or identitystore and the encryption context matches an Identity Center instance or identity store.

Use cases

  • Let users work within the Amazon Bio Discovery applications, including managing which Identity Center users and groups are assigned to them.

Best practices

  • AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

  • sso:CreateApplicationAssignment and sso:DeleteApplicationAssignment apply to all IAM Identity Center applications (arn:aws:sso::*:application/*/*), not only Amazon Bio Discovery ones, so a principal can change who is assigned to them.
  • researchstudio:* on all resources is full access to that service's actions. kms:Decrypt is limited by conditions to calls made via IAM Identity Center or the identity store.
  • You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where full access within the Amazon Bio Discovery applications is intended.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AmazonBioDiscoveryInAppFullAccess?
The reference page says you can attach AmazonBioDiscoveryInAppFullAccess to your users, groups and roles, and describes it as full access to actions within the Amazon Bio Discovery applications. Attach it for users who work in those applications.
What does AmazonBioDiscoveryInAppFullAccess grant?
It allows researchstudio:* on all resources, three identitystore list actions, three IAM Identity Center application assignment actions (create, delete and list) and kms:Decrypt under via-service conditions.
What are the security risks of AmazonBioDiscoveryInAppFullAccess?
The application assignment actions apply to all IAM Identity Center applications, so a principal can change who is assigned to them. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonBioDiscoveryInAppFullAccess",
      "Effect": "Allow",
      "Action": [
        "researchstudio:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AmazonBioDiscoveryIdentityStoreInAppAccess",
      "Effect": "Allow",
      "Action": [
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:ListGroups",
        "identitystore:ListUsers"
      ],
      "Resource": [
        "arn:aws:identitystore::*:identitystore/*",
        "arn:aws:identitystore:::user/*",
        "arn:aws:identitystore:::group/*",
        "arn:aws:identitystore:::membership/*"
      ]
    },
    {
      "Sid": "AmazonBioDiscoveryIdentityCenterInAppAccess",
      "Effect": "Allow",
      "Action": [
        "sso:CreateApplicationAssignment",
        "sso:DeleteApplicationAssignment",
        "sso:ListApplicationAssignments"
      ],
      "Resource": [
        "arn:aws:sso:::instance/*",
        "arn:aws:sso::*:application/*/*"
      ]
    },
    {
      "Sid": "AmazonBioDiscoveryIdentityCenterKMSInAppAccess",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:sso:instance-arn": "arn:aws:sso:::instance/*"
        },
        "StringLike": {
          "kms:ViaService": "sso.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AmazonBioDiscoveryIdentityStoreKMSInAppAccess",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:identitystore:identitystore-arn": "arn:aws:identitystore::*:identitystore/*"
        },
        "StringLike": {
          "kms:ViaService": "identitystore.*.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v1, edited by AWS on 2026-08-18. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonbiodiscoveryinappfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonBioDiscoveryInAppFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonBioDiscoveryInAppFullAccess"),
);

Sources