Skip to main content
IAM Policy Map

AmazonDataZoneEnvironmentRolePermissionsBoundary

AdminAWS managedActivePermissions reviewedShow on mapCompare

Summary

Amazon DataZone creates IAM roles for Environments to perform data analytics actions, and uses this policy when creating these roles to define the boundary of their permissions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN
arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary
Default version
v4
Created
Last edited
Services
athena, datazone, ec2, glue, iam, kms, lakeformation, logs, redshift, redshift-data, redshift-serverless, s3, secretsmanager, sqlworkbench, tag

Control-plane actions (739)

By access level: 286 List, 8 Permissions management, 144 Read, 7 Tagging, 294 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Athena41 of 865 List, 17 Read, 19 Write; 1 restricted, 1 conditionalathena:BatchGetNamedQuery, athena:BatchGetPreparedStatement, athena:BatchGetQueryExecution, athena:CreateNamedQuery, athena:CreateNotebook, athena:CreatePreparedStatement, athena:CreatePresignedNotebookUrl, athena:DeleteNamedQuery, athena:DeleteNotebook, athena:DeletePreparedStatement, athena:ExportNotebook, athena:GetDataCatalog and 29 more
DataZoneAll 278 actions (see the DataZone page)55 List, 6 Permissions management, 62 Read, 2 Tagging, 153 Write; 0 restricted, 0 conditionaldatazone:*
EC2199 of 834195 List, 2 Tagging, 2 Write; 2 restricted, 2 conditionalec2:CreateNetworkInterface, ec2:CreateTags, ec2:DeleteNetworkInterface, ec2:DeleteTags, ec2:Describe*
Glue86 of 3066 List, 20 Read, 60 Write; 45 restricted, 45 conditionalglue:*DataQuality*, glue:BatchCreatePartition, glue:BatchDeleteConnection, glue:BatchDeletePartition, glue:BatchDeleteTable, glue:BatchDeleteTableVersion, glue:BatchGetJobs, glue:BatchGetPartition, glue:BatchGetWorkflows, glue:BatchStopJobRun, glue:BatchUpdatePartition, glue:CreateBlueprint and 54 more
IAM7 of 1904 List, 2 Read, 1 Write; 1 restricted, 1 conditionaliam:GetRole, iam:GetRolePolicy, iam:ListGroups, iam:ListRolePolicies, iam:ListRoles, iam:ListUsers, iam:PassRole
KMS7 of 581 List, 1 Read, 5 Write; 7 restricted, 7 conditionalkms:Decrypt, kms:DescribeKey, kms:Encrypt, kms:GenerateDataKey, kms:ListKeys, kms:Sign, kms:Verify
Lake Formation4 of 681 List, 2 Read, 1 Write; 0 restricted, 0 conditionallakeformation:GetDataAccess, lakeformation:GetDataLakeSettings, lakeformation:GetResourceLFTags, lakeformation:ListPermissions
CloudWatch Logs14 of 1335 List, 7 Read, 2 Write; 0 restricted, 0 conditionallogs:CreateLogStream, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:DescribeMetricFilters, logs:DescribeQueries, logs:DescribeQueryDefinitions, logs:FilterLogEvents, logs:GetLogEvents, logs:GetLogGroupFields, logs:GetLogRecord, logs:GetQueryResults, logs:PutLogEvents and 2 more
Redshift6 of 1671 List, 2 Permissions management, 1 Read, 2 Write; 0 restricted, 0 conditionalredshift:CreateClusterUser, redshift:DescribeClusters, redshift:DescribeDataShares, redshift:GetClusterCredentials, redshift:GetClusterCredentialsWithIAM, redshift:JoinGroup
Redshift Data API7 of 121 List, 5 Read, 1 Write; 0 restricted, 0 conditionalredshift-data:DescribeStatement, redshift-data:DescribeTable, redshift-data:ExecuteStatement, redshift-data:GetStatementResult, redshift-data:ListDatabases, redshift-data:ListSchemas, redshift-data:ListTables
Redshift Serverless5 of 692 List, 2 Read, 1 Write; 0 restricted, 0 conditionalredshift-serverless:GetCredentials, redshift-serverless:GetNamespace, redshift-serverless:GetWorkgroup, redshift-serverless:ListNamespaces, redshift-serverless:ListWorkgroups
S32 of 1551 Read, 1 Write; 1 restricted, 0 conditionals3:GetBucketLocation, s3:ReplicateObject
Secrets Manager3 of 271 List, 1 Tagging, 1 Write; 2 restricted, 2 conditionalsecretsmanager:CreateSecret, secretsmanager:ListSecrets, secretsmanager:TagResource
SQL WorkbenchAll 79 actions (see the SQL Workbench page)9 List, 23 Read, 2 Tagging, 45 Write; 0 restricted, 0 conditionalsqlworkbench:*
Resource Group Tagging1 of 91 Read; 0 restricted, 0 conditionaltag:GetResources
Athena: 41 actions
  • athena:BatchGetNamedQuery (Read)
  • athena:BatchGetPreparedStatement (Read)
  • athena:BatchGetQueryExecution (Read)
  • athena:CreateNamedQuery (Write)
  • athena:CreateNotebook (Write)
  • athena:CreatePreparedStatement (Write)
  • athena:CreatePresignedNotebookUrl (Write)
  • athena:DeleteNamedQuery (Write)
  • athena:DeleteNotebook (Write)
  • athena:DeletePreparedStatement (Write)
  • athena:ExportNotebook (Write)
  • athena:GetDataCatalog (Read)
  • athena:GetDatabase (Read)
  • athena:GetNamedQuery (Read)
  • athena:GetPreparedStatement (Read)
  • athena:GetQueryExecution (Read)
  • athena:GetQueryResults (Read)
  • athena:GetQueryResultsStream (Read)
  • athena:GetQueryRuntimeStatistics (Read)
  • athena:GetTableMetadata (Read)
  • athena:GetWorkGroup (Read)
  • athena:ImportNotebook (Write)
  • athena:ListDataCatalogs (List)
  • athena:ListDatabases (List)
  • athena:ListEngineVersions (Read)
  • athena:ListNamedQueries (List)
  • athena:ListPreparedStatements (List)
  • athena:ListQueryExecutions (Read)
  • athena:ListTableMetadata (Read)
  • athena:ListTagsForResource (Read)
  • athena:ListWorkGroups (List)
  • athena:StartCalculationExecution (Write)
  • athena:StartQueryExecution (Write)
  • athena:StartSession (Write)
  • athena:StopCalculationExecution (Write)
  • athena:StopQueryExecution (Write)
  • athena:TerminateSession (Write)
  • athena:UpdateNamedQuery (Write)
  • athena:UpdateNotebook (Write)
  • athena:UpdateNotebookMetadata (Write)
  • athena:UpdatePreparedStatement (Write)
EC2: 199 actions
  • ec2:CreateNetworkInterface (Write)
  • ec2:CreateTags (Tagging)
  • ec2:DeleteNetworkInterface (Write)
  • ec2:DeleteTags (Tagging)
  • ec2:DescribeAccountAttributes (List)
  • ec2:DescribeAccountVpcEncryptionControl (List)
  • ec2:DescribeAddressTransfers (List)
  • ec2:DescribeAddresses (List)
  • ec2:DescribeAddressesAttribute (List)
  • ec2:DescribeAggregateIdFormat (List)
  • ec2:DescribeApplicationStatus (List)
  • ec2:DescribeApplicationStatusCheckAssociations (List)
  • ec2:DescribeApplicationStatusChecks (List)
  • ec2:DescribeAvailabilityZones (List)
  • ec2:DescribeAwsNetworkPerformanceMetricSubscriptions (List)
  • ec2:DescribeBundleTasks (List)
  • ec2:DescribeByoipCidrs (List)
  • ec2:DescribeCapacityBlockExtensionHistory (List)
  • ec2:DescribeCapacityBlockExtensionOfferings (List)
  • ec2:DescribeCapacityBlockOfferings (List)
  • ec2:DescribeCapacityBlockStatus (List)
  • ec2:DescribeCapacityBlocks (List)
  • ec2:DescribeCapacityManagerDataExports (List)
  • ec2:DescribeCapacityReservationBillingRequests (List)
  • ec2:DescribeCapacityReservationCancellationQuotes (List)
  • ec2:DescribeCapacityReservationDateChangeQuotes (List)
  • ec2:DescribeCapacityReservationFleets (List)
  • ec2:DescribeCapacityReservationTopology (List)
  • ec2:DescribeCapacityReservations (List)
  • ec2:DescribeCarrierGateways (List)
  • ec2:DescribeClassicLinkInstances (List)
  • ec2:DescribeClientVpnAuthorizationRules (List)
  • ec2:DescribeClientVpnConnections (List)
  • ec2:DescribeClientVpnEndpoints (List)
  • ec2:DescribeClientVpnRoutes (List)
  • ec2:DescribeClientVpnTargetNetworks (List)
  • ec2:DescribeCoipPools (List)
  • ec2:DescribeConversionTasks (List)
  • ec2:DescribeCustomerGateways (List)
  • ec2:DescribeDeclarativePoliciesReports (List)
  • ec2:DescribeDhcpOptions (List)
  • ec2:DescribeEgressOnlyInternetGateways (List)
  • ec2:DescribeElasticGpus (List)
  • ec2:DescribeExportImageTasks (List)
  • ec2:DescribeExportTasks (List)
  • ec2:DescribeFastLaunchImages (List)
  • ec2:DescribeFastSnapshotRestores (List)
  • ec2:DescribeFleetHistory (List)
  • ec2:DescribeFleetInstances (List)
  • ec2:DescribeFleets (List)
  • ec2:DescribeFlowLogs (List)
  • ec2:DescribeFpgaImageAttribute (List)
  • ec2:DescribeFpgaImages (List)
  • ec2:DescribeHostReservationOfferings (List)
  • ec2:DescribeHostReservations (List)
  • ec2:DescribeHosts (List)
  • ec2:DescribeIamInstanceProfileAssociations (List)
  • ec2:DescribeIdFormat (List)
  • ec2:DescribeIdentityIdFormat (List)
  • ec2:DescribeImageAttribute (List)
  • ec2:DescribeImageReferences (List)
  • ec2:DescribeImageUsageReportEntries (List)
  • ec2:DescribeImageUsageReports (List)
  • ec2:DescribeImages (List)
  • ec2:DescribeImportImageTasks (List)
  • ec2:DescribeImportSnapshotTasks (List)
  • ec2:DescribeInstanceAttribute (List)
  • ec2:DescribeInstanceConnectEndpoints (List)
  • ec2:DescribeInstanceCreditSpecifications (List)
  • ec2:DescribeInstanceEventNotificationAttributes (List)
  • ec2:DescribeInstanceEventWindows (List)
  • ec2:DescribeInstanceImageMetadata (List)
  • ec2:DescribeInstanceSqlHaHistoryStates (List)
  • ec2:DescribeInstanceSqlHaStates (List)
  • ec2:DescribeInstanceStatus (List)
  • ec2:DescribeInstanceTopology (List)
  • ec2:DescribeInstanceTypeOfferings (List)
  • ec2:DescribeInstanceTypes (List)
  • ec2:DescribeInstances (List)
  • ec2:DescribeInternetGateways (List)
  • ec2:DescribeIpamByoasn (List)
  • ec2:DescribeIpamExternalResourceVerificationTokens (List)
  • ec2:DescribeIpamInternetRegistryAssociations (List)
  • ec2:DescribeIpamPolicies (List)
  • ec2:DescribeIpamPoolAllocations (List)
  • ec2:DescribeIpamPools (List)
  • ec2:DescribeIpamPrefixListResolverTargets (List)
  • ec2:DescribeIpamPrefixListResolvers (List)
  • ec2:DescribeIpamResourceDiscoveries (List)
  • ec2:DescribeIpamResourceDiscoveryAssociations (List)
  • ec2:DescribeIpamScopes (List)
  • ec2:DescribeIpams (List)
  • ec2:DescribeIpv6Pools (List)
  • ec2:DescribeKeyPairs (List)
  • ec2:DescribeLaunchTemplateVersions (List)
  • ec2:DescribeLaunchTemplates (List)
  • ec2:DescribeLocalGatewayRouteTablePermissions (List)
  • ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations (List)
  • ec2:DescribeLocalGatewayRouteTableVpcAssociations (List)
  • ec2:DescribeLocalGatewayRouteTables (List)
  • ec2:DescribeLocalGatewayVirtualInterfaceGroups (List)
  • ec2:DescribeLocalGatewayVirtualInterfaces (List)
  • ec2:DescribeLocalGateways (List)
  • ec2:DescribeLockedSnapshots (List)
  • ec2:DescribeMacHosts (List)
  • ec2:DescribeMacModificationTasks (List)
  • ec2:DescribeManagedPrefixLists (List)
  • ec2:DescribeMovingAddresses (List)
  • ec2:DescribeNatGateways (List)
  • ec2:DescribeNetworkAcls (List)
  • ec2:DescribeNetworkInsightsAccessScopeAnalyses (List)
  • ec2:DescribeNetworkInsightsAccessScopes (List)
  • ec2:DescribeNetworkInsightsAnalyses (List)
  • ec2:DescribeNetworkInsightsPaths (List)
  • ec2:DescribeNetworkInterfaceAttribute (List)
  • ec2:DescribeNetworkInterfacePermissions (List)
  • ec2:DescribeNetworkInterfaces (List)
  • ec2:DescribeOutpostLags (List)
  • ec2:DescribePlacementGroups (List)
  • ec2:DescribePrefixLists (List)
  • ec2:DescribePrincipalIdFormat (List)
  • ec2:DescribePublicIpv4Pools (List)
  • ec2:DescribeRegions (List)
  • ec2:DescribeReplaceRootVolumeTasks (List)
  • ec2:DescribeReservedInstances (List)
  • ec2:DescribeReservedInstancesListings (List)
  • ec2:DescribeReservedInstancesModifications (List)
  • ec2:DescribeReservedInstancesOfferings (List)
  • ec2:DescribeRouteServerEndpoints (List)
  • ec2:DescribeRouteServerPeers (List)
  • ec2:DescribeRouteServers (List)
  • ec2:DescribeRouteTables (List)
  • ec2:DescribeScheduledInstanceAvailability (List)
  • ec2:DescribeScheduledInstances (List)
  • ec2:DescribeSecondaryInterfaces (List)
  • ec2:DescribeSecondaryNetworks (List)
  • ec2:DescribeSecondarySubnets (List)
  • ec2:DescribeSecurityGroupReferences (List)
  • ec2:DescribeSecurityGroupRules (List)
  • ec2:DescribeSecurityGroupVpcAssociations (List)
  • ec2:DescribeSecurityGroups (List)
  • ec2:DescribeServiceLinkVirtualInterfaces (List)
  • ec2:DescribeSnapshotAttribute (List)
  • ec2:DescribeSnapshotTierStatus (List)
  • ec2:DescribeSnapshots (List)
  • ec2:DescribeSpotDatafeedSubscription (List)
  • ec2:DescribeSpotFleetInstances (List)
  • ec2:DescribeSpotFleetRequestHistory (List)
  • ec2:DescribeSpotFleetRequests (List)
  • ec2:DescribeSpotInstanceRequests (List)
  • ec2:DescribeSpotPriceHistory (List)
  • ec2:DescribeStaleSecurityGroups (List)
  • ec2:DescribeStoreImageTasks (List)
  • ec2:DescribeSubnets (List)
  • ec2:DescribeTags (List)
  • ec2:DescribeTrafficMirrorFilterRules (List)
  • ec2:DescribeTrafficMirrorFilters (List)
  • ec2:DescribeTrafficMirrorSessions (List)
  • ec2:DescribeTrafficMirrorTargets (List)
  • ec2:DescribeTransitGatewayAttachments (List)
  • ec2:DescribeTransitGatewayConnectPeers (List)
  • ec2:DescribeTransitGatewayConnects (List)
  • ec2:DescribeTransitGatewayMeteringPolicies (List)
  • ec2:DescribeTransitGatewayMulticastDomains (List)
  • ec2:DescribeTransitGatewayPeeringAttachments (List)
  • ec2:DescribeTransitGatewayPolicyTables (List)
  • ec2:DescribeTransitGatewayRouteTableAnnouncements (List)
  • ec2:DescribeTransitGatewayRouteTables (List)
  • ec2:DescribeTransitGatewayVpcAttachments (List)
  • ec2:DescribeTransitGateways (List)
  • ec2:DescribeTrunkInterfaceAssociations (List)
  • ec2:DescribeVerifiedAccessEndpoints (List)
  • ec2:DescribeVerifiedAccessGroups (List)
  • ec2:DescribeVerifiedAccessInstanceLoggingConfigurations (List)
  • ec2:DescribeVerifiedAccessInstanceWebAclAssociations (List)
  • ec2:DescribeVerifiedAccessInstances (List)
  • ec2:DescribeVerifiedAccessTrustProviders (List)
  • ec2:DescribeVolumeAttribute (List)
  • ec2:DescribeVolumeStatus (List)
  • ec2:DescribeVolumes (List)
  • ec2:DescribeVolumesModifications (List)
  • ec2:DescribeVpcAttribute (List)
  • ec2:DescribeVpcBlockPublicAccessExclusions (List)
  • ec2:DescribeVpcBlockPublicAccessOptions (List)
  • ec2:DescribeVpcClassicLink (List)
  • ec2:DescribeVpcClassicLinkDnsSupport (List)
  • ec2:DescribeVpcEncryptionControls (List)
  • ec2:DescribeVpcEndpointAssociations (List)
  • ec2:DescribeVpcEndpointConnectionNotifications (List)
  • ec2:DescribeVpcEndpointConnections (List)
  • ec2:DescribeVpcEndpointServiceConfigurations (List)
  • ec2:DescribeVpcEndpointServicePermissions (List)
  • ec2:DescribeVpcEndpointServices (List)
  • ec2:DescribeVpcEndpoints (List)
  • ec2:DescribeVpcPeeringConnections (List)
  • ec2:DescribeVpcs (List)
  • ec2:DescribeVpnConcentrators (List)
  • ec2:DescribeVpnConnections (List)
  • ec2:DescribeVpnGateways (List)
Glue: 86 actions
  • glue:AccessDataQualityRuntimeConfiguration (Read)
  • glue:BatchCreatePartition (Write)
  • glue:BatchDeleteConnection (Write)
  • glue:BatchDeletePartition (Write)
  • glue:BatchDeleteTable (Write)
  • glue:BatchDeleteTableVersion (Write)
  • glue:BatchGetJobs (Read)
  • glue:BatchGetPartition (Read)
  • glue:BatchGetWorkflows (Read)
  • glue:BatchStopJobRun (Write)
  • glue:BatchUpdatePartition (Write)
  • glue:CancelDataQualityRuleRecommendationRun (Write)
  • glue:CancelDataQualityRulesetEvaluationRun (Write)
  • glue:CreateBlueprint (Write)
  • glue:CreateConnection (Write)
  • glue:CreateCrawler (Write)
  • glue:CreateDataQualityRuleset (Write)
  • glue:CreateDatabase (Write)
  • glue:CreateJob (Write)
  • glue:CreatePartition (Write)
  • glue:CreatePartitionIndex (Write)
  • glue:CreateTable (Write)
  • glue:CreateWorkflow (Write)
  • glue:DeleteBlueprint (Write)
  • glue:DeleteColumnStatisticsForPartition (Write)
  • glue:DeleteColumnStatisticsForTable (Write)
  • glue:DeleteConnection (Write)
  • glue:DeleteCrawler (Write)
  • glue:DeleteDataQualityRuleset (Write)
  • glue:DeleteJob (Write)
  • glue:DeletePartition (Write)
  • glue:DeletePartitionIndex (Write)
  • glue:DeleteTable (Write)
  • glue:DeleteTableVersion (Write)
  • glue:DeleteWorkflow (Write)
  • glue:GetColumnStatisticsForPartition (Read)
  • glue:GetColumnStatisticsForTable (Read)
  • glue:GetConnection (Read)
  • glue:GetDataQualityModel (Read)
  • glue:GetDataQualityModelResult (Read)
  • glue:GetDataQualityResult (Read)
  • glue:GetDataQualityRuleRecommendationRun (Read)
  • glue:GetDataQualityRuleset (Read)
  • glue:GetDataQualityRulesetEvaluationRun (Read)
  • glue:GetDatabase (Read)
  • glue:GetDatabases (Read)
  • glue:GetPartition (Read)
  • glue:GetPartitions (Read)
  • glue:GetTable (Read)
  • glue:GetTables (Read)
  • glue:ListDataQualityResults (List)
  • glue:ListDataQualityRuleRecommendationRuns (List)
  • glue:ListDataQualityRulesetEvaluationRuns (List)
  • glue:ListDataQualityRulesets (List)
  • glue:ListJobs (List)
  • glue:ListSchemas (List)
  • glue:NotifyEvent (Write)
  • glue:PublishDataQuality (Write)
  • glue:PutDataQualityProfileAnnotation (Write)
  • glue:PutDataQualityStatisticAnnotation (Write)
  • glue:PutWorkflowRunProperties (Write)
  • glue:ResetJobBookmark (Write)
  • glue:ResumeWorkflowRun (Write)
  • glue:SearchTables (Read)
  • glue:StartBlueprintRun (Write)
  • glue:StartCrawler (Write)
  • glue:StartCrawlerSchedule (Write)
  • glue:StartDataQualityRuleRecommendationRun (Write)
  • glue:StartDataQualityRulesetEvaluationRun (Write)
  • glue:StartJobRun (Write)
  • glue:StartWorkflowRun (Write)
  • glue:StopCrawler (Write)
  • glue:StopCrawlerSchedule (Write)
  • glue:StopWorkflowRun (Write)
  • glue:UpdateBlueprint (Write)
  • glue:UpdateColumnStatisticsForPartition (Write)
  • glue:UpdateColumnStatisticsForTable (Write)
  • glue:UpdateConnection (Write)
  • glue:UpdateCrawler (Write)
  • glue:UpdateCrawlerSchedule (Write)
  • glue:UpdateDataQualityRuleset (Write)
  • glue:UpdateDatabase (Write)
  • glue:UpdateJob (Write)
  • glue:UpdatePartition (Write)
  • glue:UpdateTable (Write)
  • glue:UpdateWorkflow (Write)
IAM: 7 actions
  • iam:GetRole (Read)
  • iam:GetRolePolicy (Read)
  • iam:ListGroups (List)
  • iam:ListRolePolicies (List)
  • iam:ListRoles (List)
  • iam:ListUsers (List)
  • iam:PassRole (Write)
KMS: 7 actions
  • kms:Decrypt (Write)
  • kms:DescribeKey (Read)
  • kms:Encrypt (Write)
  • kms:GenerateDataKey (Write)
  • kms:ListKeys (List)
  • kms:Sign (Write)
  • kms:Verify (Write)
Lake Formation: 4 actions
  • lakeformation:GetDataAccess (Write)
  • lakeformation:GetDataLakeSettings (Read)
  • lakeformation:GetResourceLFTags (Read)
  • lakeformation:ListPermissions (List)
CloudWatch Logs: 14 actions
  • logs:CreateLogStream (Write)
  • logs:DescribeLogGroups (List)
  • logs:DescribeLogStreams (List)
  • logs:DescribeMetricFilters (List)
  • logs:DescribeQueries (List)
  • logs:DescribeQueryDefinitions (List)
  • logs:FilterLogEvents (Read)
  • logs:GetLogEvents (Read)
  • logs:GetLogGroupFields (Read)
  • logs:GetLogRecord (Read)
  • logs:GetQueryResults (Read)
  • logs:PutLogEvents (Write)
  • logs:StartQuery (Read)
  • logs:StopQuery (Read)
Redshift: 6 actions
  • redshift:CreateClusterUser (Permissions management)
  • redshift:DescribeClusters (List)
  • redshift:DescribeDataShares (Read)
  • redshift:GetClusterCredentials (Write)
  • redshift:GetClusterCredentialsWithIAM (Write)
  • redshift:JoinGroup (Permissions management)
Redshift Data API: 7 actions
  • redshift-data:DescribeStatement (Read)
  • redshift-data:DescribeTable (Read)
  • redshift-data:ExecuteStatement (Write)
  • redshift-data:GetStatementResult (Read)
  • redshift-data:ListDatabases (Read)
  • redshift-data:ListSchemas (Read)
  • redshift-data:ListTables (List)
Redshift Serverless: 5 actions
  • redshift-serverless:GetCredentials (Write)
  • redshift-serverless:GetNamespace (Read)
  • redshift-serverless:GetWorkgroup (Read)
  • redshift-serverless:ListNamespaces (List)
  • redshift-serverless:ListWorkgroups (List)
S3: 2 actions
  • s3:GetBucketLocation (Read)
  • s3:ReplicateObject (Write)
Secrets Manager: 3 actions
  • secretsmanager:CreateSecret (Write)
  • secretsmanager:ListSecrets (List)
  • secretsmanager:TagResource (Tagging)
Resource Group Tagging: 1 actions
  • tag:GetResources (Read)

Data-plane actions (8)

By access level: 1 List, 1 Read, 6 Write.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
S38 of 251 List, 1 Read, 6 Write; 8 restricted, 1 conditionals3:AbortMultipartUpload, s3:DeleteObject, s3:DeleteObjectVersion, s3:GetObject, s3:ListBucket, s3:PutObject, s3:PutObjectRetention, s3:RestoreObject
S3: 8 actions
  • s3:AbortMultipartUpload (Write)
  • s3:DeleteObject (Write)
  • s3:DeleteObjectVersion (Write)
  • s3:GetObject (Read)
  • s3:ListBucket (List)
  • s3:PutObject (Write)
  • s3:PutObjectRetention (Write)
  • s3:RestoreObject (Write)

Excluded and conditional actions

  • athena:BatchGetNamedQuery (deny-not-action, statement 12): 1 matching actions
  • athena:BatchGetPreparedStatement (deny-not-action, statement 12): 1 matching actions
  • athena:BatchGetQueryExecution (deny-not-action, statement 12): 1 matching actions
  • athena:CreateNamedQuery (deny-not-action, statement 12): 1 matching actions
  • athena:CreateNotebook (deny-not-action, statement 12): 1 matching actions
  • athena:CreatePreparedStatement (deny-not-action, statement 12): 1 matching actions
  • athena:CreatePresignedNotebookUrl (deny-not-action, statement 12): 1 matching actions
  • athena:DeleteNamedQuery (deny-not-action, statement 12): 1 matching actions
  • athena:DeleteNotebook (deny-not-action, statement 12): 1 matching actions
  • athena:DeletePreparedStatement (deny-not-action, statement 12): 1 matching actions
  • athena:ExportNotebook (deny-not-action, statement 12): 1 matching actions
  • athena:GetDataCatalog (deny-not-action, statement 12): 1 matching actions
  • athena:GetDatabase (deny-not-action, statement 12): 1 matching actions
  • athena:GetNamedQuery (deny-not-action, statement 12): 1 matching actions
  • athena:GetPreparedStatement (deny-not-action, statement 12): 1 matching actions
  • athena:GetQueryExecution (deny-not-action, statement 12): 1 matching actions
  • athena:GetQueryResults (deny-not-action, statement 12): 1 matching actions
  • athena:GetQueryResultsStream (deny-not-action, statement 12): 1 matching actions
  • athena:GetQueryRuntimeStatistics (deny-not-action, statement 12): 1 matching actions
  • athena:GetTableMetadata (deny-not-action, statement 12): 1 matching actions
  • athena:GetWorkGroup (deny-not-action, statement 12): 1 matching actions
  • athena:ImportNotebook (deny-not-action, statement 12): 1 matching actions
  • athena:ListDataCatalogs (deny-not-action, statement 12): 1 matching actions
  • athena:ListDatabases (deny-not-action, statement 12): 1 matching actions
  • athena:ListEngineVersions (deny-not-action, statement 12): 1 matching actions
  • athena:ListNamedQueries (deny-not-action, statement 12): 1 matching actions
  • athena:ListPreparedStatements (deny-not-action, statement 12): 1 matching actions
  • athena:ListQueryExecutions (deny-not-action, statement 12): 1 matching actions
  • athena:ListTableMetadata (deny-not-action, statement 12): 1 matching actions
  • athena:ListTagsForResource (deny-not-action, statement 12): 1 matching actions
  • athena:ListWorkGroups (deny-not-action, statement 12): 1 matching actions
  • athena:StartCalculationExecution (deny-not-action, statement 12): 1 matching actions
  • athena:StartQueryExecution (deny-not-action, statement 12): 1 matching actions
  • athena:StartSession (deny-not-action, statement 12): 1 matching actions
  • athena:StopCalculationExecution (deny-not-action, statement 12): 1 matching actions
  • athena:StopQueryExecution (deny-not-action, statement 12): 1 matching actions
  • athena:TerminateSession (deny-not-action, statement 12): 1 matching actions
  • athena:UpdateNamedQuery (deny-not-action, statement 12): 1 matching actions
  • athena:UpdateNotebook (deny-not-action, statement 12): 1 matching actions
  • athena:UpdateNotebookMetadata (deny-not-action, statement 12): 1 matching actions
  • athena:UpdatePreparedStatement (deny-not-action, statement 12): 1 matching actions
  • datazone:* (deny-not-action, statement 12): 278 matching actions
  • ec2:CreateNetworkInterface (deny-not-action, statement 12): 1 matching actions
  • ec2:CreateTags (deny-not-action, statement 12): 1 matching actions
  • ec2:DeleteNetworkInterface (deny-not-action, statement 12): 1 matching actions
  • ec2:DeleteTags (deny-not-action, statement 12): 1 matching actions
  • ec2:Describe* (deny-not-action, statement 12): 195 matching actions
  • glue:*DataQuality* (deny-not-action, statement 12): 21 matching actions
  • glue:BatchCreatePartition (deny-not-action, statement 12): 1 matching actions
  • glue:BatchDeleteConnection (deny-not-action, statement 12): 1 matching actions
  • glue:BatchDeletePartition (deny-not-action, statement 12): 1 matching actions
  • glue:BatchDeleteTable (deny-not-action, statement 12): 1 matching actions
  • glue:BatchDeleteTableVersion (deny-not-action, statement 12): 1 matching actions
  • glue:BatchGetJobs (deny-not-action, statement 12): 1 matching actions
  • glue:BatchGetPartition (deny-not-action, statement 12): 1 matching actions
  • glue:BatchGetWorkflows (deny-not-action, statement 12): 1 matching actions
  • glue:BatchStopJobRun (deny-not-action, statement 12): 1 matching actions
  • glue:BatchUpdatePartition (deny-not-action, statement 12): 1 matching actions
  • glue:CreateBlueprint (deny-not-action, statement 12): 1 matching actions
  • glue:CreateConnection (deny-not-action, statement 12): 1 matching actions
  • glue:CreateCrawler (deny-not-action, statement 12): 1 matching actions
  • glue:CreateDatabase (deny-not-action, statement 12): 1 matching actions
  • glue:CreateJob (deny-not-action, statement 12): 1 matching actions
  • glue:CreatePartition (deny-not-action, statement 12): 1 matching actions
  • glue:CreatePartitionIndex (deny-not-action, statement 12): 1 matching actions
  • glue:CreateTable (deny-not-action, statement 12): 1 matching actions
  • glue:CreateWorkflow (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteBlueprint (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteColumnStatisticsForPartition (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteColumnStatisticsForTable (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteConnection (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteCrawler (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteJob (deny-not-action, statement 12): 1 matching actions
  • glue:DeletePartition (deny-not-action, statement 12): 1 matching actions
  • glue:DeletePartitionIndex (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteTable (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteTableVersion (deny-not-action, statement 12): 1 matching actions
  • glue:DeleteWorkflow (deny-not-action, statement 12): 1 matching actions
  • glue:GetColumnStatisticsForPartition (deny-not-action, statement 12): 1 matching actions
  • glue:GetColumnStatisticsForTable (deny-not-action, statement 12): 1 matching actions
  • glue:GetConnection (deny-not-action, statement 12): 1 matching actions
  • glue:GetDatabase (deny-not-action, statement 12): 1 matching actions
  • glue:GetDatabases (deny-not-action, statement 12): 1 matching actions
  • glue:GetPartition (deny-not-action, statement 12): 1 matching actions
  • glue:GetPartitions (deny-not-action, statement 12): 1 matching actions
  • glue:GetTable (deny-not-action, statement 12): 1 matching actions
  • glue:GetTables (deny-not-action, statement 12): 1 matching actions
  • glue:ListJobs (deny-not-action, statement 12): 1 matching actions
  • glue:ListSchemas (deny-not-action, statement 12): 1 matching actions
  • glue:NotifyEvent (deny-not-action, statement 12): 1 matching actions
  • glue:PutWorkflowRunProperties (deny-not-action, statement 12): 1 matching actions
  • glue:ResetJobBookmark (deny-not-action, statement 12): 1 matching actions
  • glue:ResumeWorkflowRun (deny-not-action, statement 12): 1 matching actions
  • glue:SearchTables (deny-not-action, statement 12): 1 matching actions
  • glue:StartBlueprintRun (deny-not-action, statement 12): 1 matching actions
  • glue:StartCrawler (deny-not-action, statement 12): 1 matching actions
  • glue:StartCrawlerSchedule (deny-not-action, statement 12): 1 matching actions
  • glue:StartJobRun (deny-not-action, statement 12): 1 matching actions
  • glue:StartWorkflowRun (deny-not-action, statement 12): 1 matching actions
  • glue:StopCrawler (deny-not-action, statement 12): 1 matching actions
  • glue:StopCrawlerSchedule (deny-not-action, statement 12): 1 matching actions
  • glue:StopWorkflowRun (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateBlueprint (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateColumnStatisticsForPartition (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateColumnStatisticsForTable (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateConnection (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateCrawler (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateCrawlerSchedule (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateDatabase (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateJob (deny-not-action, statement 12): 1 matching actions
  • glue:UpdatePartition (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateTable (deny-not-action, statement 12): 1 matching actions
  • glue:UpdateWorkflow (deny-not-action, statement 12): 1 matching actions
  • iam:GetRole (deny-not-action, statement 12): 1 matching actions
  • iam:GetRolePolicy (deny-not-action, statement 12): 1 matching actions
  • iam:List* (deny-not-action, statement 12): 38 matching actions
  • iam:PassRole (deny-not-action, statement 12): 1 matching actions
  • kms:Decrypt (deny-not-action, statement 12): 1 matching actions
  • kms:DescribeKey (deny-not-action, statement 12): 1 matching actions
  • kms:Encrypt (deny-not-action, statement 12): 1 matching actions
  • kms:GenerateDataKey (deny-not-action, statement 12): 1 matching actions
  • kms:ListKeys (deny-not-action, statement 12): 1 matching actions
  • kms:Sign (deny-not-action, statement 12): 1 matching actions
  • kms:Verify (deny-not-action, statement 12): 1 matching actions
  • lakeformation:GetDataAccess (deny-not-action, statement 12): 1 matching actions
  • lakeformation:GetDataLakeSettings (deny-not-action, statement 12): 1 matching actions
  • lakeformation:GetResourceLFTags (deny-not-action, statement 12): 1 matching actions
  • lakeformation:ListPermissions (deny-not-action, statement 12): 1 matching actions
  • logs:CreateLogStream (deny-not-action, statement 12): 1 matching actions
  • logs:DescribeLogGroups (deny-not-action, statement 12): 1 matching actions
  • logs:DescribeLogStreams (deny-not-action, statement 12): 1 matching actions
  • logs:DescribeMetricFilters (deny-not-action, statement 12): 1 matching actions
  • logs:DescribeQueries (deny-not-action, statement 12): 1 matching actions
  • logs:DescribeQueryDefinitions (deny-not-action, statement 12): 1 matching actions
  • logs:FilterLogEvents (deny-not-action, statement 12): 1 matching actions
  • logs:GetLogEvents (deny-not-action, statement 12): 1 matching actions
  • logs:GetLogGroupFields (deny-not-action, statement 12): 1 matching actions
  • logs:GetLogRecord (deny-not-action, statement 12): 1 matching actions
  • logs:GetQueryResults (deny-not-action, statement 12): 1 matching actions
  • logs:PutLogEvents (deny-not-action, statement 12): 1 matching actions
  • logs:StartQuery (deny-not-action, statement 12): 1 matching actions
  • logs:StopQuery (deny-not-action, statement 12): 1 matching actions
  • redshift-data:DescribeStatement (deny-not-action, statement 12): 1 matching actions
  • redshift-data:DescribeTable (deny-not-action, statement 12): 1 matching actions
  • redshift-data:ExecuteStatement (deny-not-action, statement 12): 1 matching actions
  • redshift-data:GetStatementResult (deny-not-action, statement 12): 1 matching actions
  • redshift-data:ListDatabases (deny-not-action, statement 12): 1 matching actions
  • redshift-data:ListSchemas (deny-not-action, statement 12): 1 matching actions
  • redshift-data:ListTables (deny-not-action, statement 12): 1 matching actions
  • redshift-serverless:GetCredentials (deny-not-action, statement 12): 1 matching actions
  • redshift-serverless:GetNamespace (deny-not-action, statement 12): 1 matching actions
  • redshift-serverless:GetWorkgroup (deny-not-action, statement 12): 1 matching actions
  • redshift-serverless:ListNamespaces (deny-not-action, statement 12): 1 matching actions
  • redshift-serverless:ListWorkgroups (deny-not-action, statement 12): 1 matching actions
  • redshift:CreateClusterUser (deny-not-action, statement 12): 1 matching actions
  • redshift:DescribeClusters (deny-not-action, statement 12): 1 matching actions
  • redshift:DescribeDataShares (deny-not-action, statement 12): 1 matching actions
  • redshift:GetClusterCredentials (deny-not-action, statement 12): 1 matching actions
  • redshift:GetClusterCredentialsWithIAM (deny-not-action, statement 12): 1 matching actions
  • redshift:JoinGroup (deny-not-action, statement 12): 1 matching actions
  • s3:AbortMultipartUpload (deny-not-action, statement 12): 1 matching actions
  • s3:DeleteObject (deny-not-action, statement 12): 1 matching actions
  • s3:DeleteObjectVersion (deny-not-action, statement 12): 1 matching actions
  • s3:GetBucketLocation (deny-not-action, statement 12): 1 matching actions
  • s3:GetObject (deny-not-action, statement 12): 1 matching actions
  • s3:ListBucket (deny-not-action, statement 12): 1 matching actions
  • s3:PutObject (deny-not-action, statement 12): 1 matching actions
  • s3:PutObjectRetention (deny-not-action, statement 12): 1 matching actions
  • s3:ReplicateObject (deny-not-action, statement 12): 1 matching actions
  • s3:RestoreObject (deny-not-action, statement 12): 1 matching actions
  • secretsmanager:CreateSecret (deny-not-action, statement 12): 1 matching actions
  • secretsmanager:ListSecrets (deny-not-action, statement 12): 1 matching actions
  • secretsmanager:TagResource (deny-not-action, statement 12): 1 matching actions
  • sqlworkbench:* (deny-not-action, statement 12): 79 matching actions
  • tag:GetResources (deny-not-action, statement 12): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants at least 80% of the write and permissions-management actions of: datazone (159 of 159), sqlworkbench (45 of 45).
  • Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
  • Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateGlueConnection",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:network-interface/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "aws-glue-service-resource"
          ]
        }
      }
    },
    {
      "Sid": "GlueOperations",
      "Effect": "Allow",
      "Action": [
        "glue:*DataQuality*",
        "glue:BatchCreatePartition",
        "glue:BatchDeleteConnection",
        "glue:BatchDeletePartition",
        "glue:BatchDeleteTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchGetJobs",
        "glue:BatchGetWorkflows",
        "glue:BatchStopJobRun",
        "glue:BatchUpdatePartition",
        "glue:CreateBlueprint",
        "glue:CreateConnection",
        "glue:CreateCrawler",
        "glue:CreateDatabase",
        "glue:CreateJob",
        "glue:CreatePartition",
        "glue:CreatePartitionIndex",
        "glue:CreateTable",
        "glue:CreateWorkflow",
        "glue:DeleteBlueprint",
        "glue:DeleteColumnStatisticsForPartition",
        "glue:DeleteColumnStatisticsForTable",
        "glue:DeleteConnection",
        "glue:DeleteCrawler",
        "glue:DeleteJob",
        "glue:DeletePartition",
        "glue:DeletePartitionIndex",
        "glue:DeleteTable",
        "glue:DeleteTableVersion",
        "glue:DeleteWorkflow",
        "glue:GetColumnStatisticsForPartition",
        "glue:GetColumnStatisticsForTable",
        "glue:GetConnection",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:ListSchemas",
        "glue:ListJobs",
        "glue:NotifyEvent",
        "glue:PutWorkflowRunProperties",
        "glue:ResetJobBookmark",
        "glue:ResumeWorkflowRun",
        "glue:SearchTables",
        "glue:StartBlueprintRun",
        "glue:StartCrawler",
        "glue:StartCrawlerSchedule",
        "glue:StartJobRun",
        "glue:StartWorkflowRun",
        "glue:StopCrawler",
        "glue:StopCrawlerSchedule",
        "glue:StopWorkflowRun",
        "glue:UpdateBlueprint",
        "glue:UpdateColumnStatisticsForPartition",
        "glue:UpdateColumnStatisticsForTable",
        "glue:UpdateConnection",
        "glue:UpdateCrawler",
        "glue:UpdateCrawlerSchedule",
        "glue:UpdateDatabase",
        "glue:UpdateJob",
        "glue:UpdatePartition",
        "glue:UpdateTable",
        "glue:UpdateWorkflow"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "PassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/datazone*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "glue.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SameAccountKmsOperations",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:ListKeys"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "KmsOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:ListKeys",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:Verify",
        "kms:Sign"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "AnalyticsOperations",
      "Effect": "Allow",
      "Action": [
        "datazone:*",
        "sqlworkbench:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "QueryOperations",
      "Effect": "Allow",
      "Action": [
        "athena:BatchGetNamedQuery",
        "athena:BatchGetPreparedStatement",
        "athena:BatchGetQueryExecution",
        "athena:CreateNamedQuery",
        "athena:CreateNotebook",
        "athena:CreatePreparedStatement",
        "athena:CreatePresignedNotebookUrl",
        "athena:DeleteNamedQuery",
        "athena:DeleteNotebook",
        "athena:DeletePreparedStatement",
        "athena:ExportNotebook",
        "athena:GetDatabase",
        "athena:GetDataCatalog",
        "athena:GetNamedQuery",
        "athena:GetPreparedStatement",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryRuntimeStatistics",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ImportNotebook",
        "athena:ListDatabases",
        "athena:ListDataCatalogs",
        "athena:ListEngineVersions",
        "athena:ListNamedQueries",
        "athena:ListPreparedStatements",
        "athena:ListQueryExecutions",
        "athena:ListTableMetadata",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "athena:StartCalculationExecution",
        "athena:StartQueryExecution",
        "athena:StartSession",
        "athena:StopCalculationExecution",
        "athena:StopQueryExecution",
        "athena:TerminateSession",
        "athena:UpdateNamedQuery",
        "athena:UpdateNotebook",
        "athena:UpdateNotebookMetadata",
        "athena:UpdatePreparedStatement",
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:Describe*",
        "glue:BatchCreatePartition",
        "glue:BatchDeletePartition",
        "glue:BatchDeleteTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchGetJobs",
        "glue:BatchGetPartition",
        "glue:BatchGetWorkflows",
        "glue:BatchUpdatePartition",
        "glue:CreateBlueprint",
        "glue:CreateConnection",
        "glue:CreateCrawler",
        "glue:CreateDatabase",
        "glue:CreateJob",
        "glue:CreatePartition",
        "glue:CreatePartitionIndex",
        "glue:CreateTable",
        "glue:CreateWorkflow",
        "glue:DeleteColumnStatisticsForPartition",
        "glue:DeleteColumnStatisticsForTable",
        "glue:DeletePartition",
        "glue:DeletePartitionIndex",
        "glue:DeleteTable",
        "glue:DeleteTableVersion",
        "glue:GetColumnStatisticsForPartition",
        "glue:GetColumnStatisticsForTable",
        "glue:GetConnection",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:ListSchemas",
        "glue:ListJobs",
        "glue:NotifyEvent",
        "glue:SearchTables",
        "glue:UpdateColumnStatisticsForPartition",
        "glue:UpdateColumnStatisticsForTable",
        "glue:UpdateDatabase",
        "glue:UpdatePartition",
        "glue:UpdateTable",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListGroups",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "iam:ListUsers",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeMetricFilters",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:GetLogEvents",
        "logs:GetLogGroupFields",
        "logs:GetQueryResults",
        "logs:GetLogRecord",
        "logs:PutLogEvents",
        "logs:CreateLogStream",
        "logs:FilterLogEvents",
        "lakeformation:GetDataAccess",
        "lakeformation:GetDataLakeSettings",
        "lakeformation:GetResourceLFTags",
        "lakeformation:ListPermissions",
        "redshift-data:ListTables",
        "redshift-data:DescribeTable",
        "redshift-data:ListSchemas",
        "redshift-data:ListDatabases",
        "redshift-data:ExecuteStatement",
        "redshift-data:GetStatementResult",
        "redshift-data:DescribeStatement",
        "redshift:CreateClusterUser",
        "redshift:DescribeClusters",
        "redshift:DescribeDataShares",
        "redshift:GetClusterCredentials",
        "redshift:GetClusterCredentialsWithIAM",
        "redshift:JoinGroup",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListWorkgroups",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:GetCredentials",
        "secretsmanager:ListSecrets",
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "QueryOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "athena:GetQueryResultsStream"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "SecretsManagerOperationsWithTagKeys",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
      "Condition": {
        "StringLike": {
          "aws:ResourceTag/AmazonDataZoneDomain": "*",
          "aws:ResourceTag/AmazonDataZoneProject": "*"
        },
        "Null": {
          "aws:TagKeys": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "AmazonDataZoneDomain",
            "AmazonDataZoneProject"
          ]
        }
      }
    },
    {
      "Sid": "DataZoneS3Buckets",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectRetention",
        "s3:ReplicateObject",
        "s3:RestoreObject"
      ],
      "Resource": [
        "arn:aws:s3:::*/datazone/*"
      ]
    },
    {
      "Sid": "DataZoneS3BucketLocation",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ListDataZoneS3Bucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "*/datazone/*",
            "datazone/*"
          ]
        }
      }
    },
    {
      "Sid": "NotDeniedOperations",
      "Effect": "Deny",
      "NotAction": [
        "datazone:*",
        "sqlworkbench:*",
        "athena:BatchGetNamedQuery",
        "athena:BatchGetPreparedStatement",
        "athena:BatchGetQueryExecution",
        "athena:CreateNamedQuery",
        "athena:CreateNotebook",
        "athena:CreatePreparedStatement",
        "athena:CreatePresignedNotebookUrl",
        "athena:DeleteNamedQuery",
        "athena:DeleteNotebook",
        "athena:DeletePreparedStatement",
        "athena:ExportNotebook",
        "athena:GetDatabase",
        "athena:GetDataCatalog",
        "athena:GetNamedQuery",
        "athena:GetPreparedStatement",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryResultsStream",
        "athena:GetQueryRuntimeStatistics",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ImportNotebook",
        "athena:ListDatabases",
        "athena:ListDataCatalogs",
        "athena:ListEngineVersions",
        "athena:ListNamedQueries",
        "athena:ListPreparedStatements",
        "athena:ListQueryExecutions",
        "athena:ListTableMetadata",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "athena:StartCalculationExecution",
        "athena:StartQueryExecution",
        "athena:StartSession",
        "athena:StopCalculationExecution",
        "athena:StopQueryExecution",
        "athena:TerminateSession",
        "athena:UpdateNamedQuery",
        "athena:UpdateNotebook",
        "athena:UpdateNotebookMetadata",
        "athena:UpdatePreparedStatement",
        "ec2:CreateNetworkInterface",
        "ec2:CreateTags",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteTags",
        "ec2:Describe*",
        "glue:*DataQuality*",
        "glue:BatchCreatePartition",
        "glue:BatchDeleteConnection",
        "glue:BatchDeletePartition",
        "glue:BatchDeleteTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchGetJobs",
        "glue:BatchGetPartition",
        "glue:BatchGetWorkflows",
        "glue:BatchStopJobRun",
        "glue:BatchUpdatePartition",
        "glue:CreateBlueprint",
        "glue:CreateConnection",
        "glue:CreateCrawler",
        "glue:CreateDatabase",
        "glue:CreateJob",
        "glue:CreatePartition",
        "glue:CreatePartitionIndex",
        "glue:CreateTable",
        "glue:CreateWorkflow",
        "glue:DeleteBlueprint",
        "glue:DeleteColumnStatisticsForPartition",
        "glue:DeleteColumnStatisticsForTable",
        "glue:DeleteConnection",
        "glue:DeleteCrawler",
        "glue:DeleteJob",
        "glue:DeletePartition",
        "glue:DeletePartitionIndex",
        "glue:DeleteTable",
        "glue:DeleteTableVersion",
        "glue:DeleteWorkflow",
        "glue:GetColumnStatisticsForPartition",
        "glue:GetColumnStatisticsForTable",
        "glue:GetConnection",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:ListSchemas",
        "glue:ListJobs",
        "glue:NotifyEvent",
        "glue:PutWorkflowRunProperties",
        "glue:ResetJobBookmark",
        "glue:ResumeWorkflowRun",
        "glue:SearchTables",
        "glue:StartBlueprintRun",
        "glue:StartCrawler",
        "glue:StartCrawlerSchedule",
        "glue:StartJobRun",
        "glue:StartWorkflowRun",
        "glue:StopCrawler",
        "glue:StopCrawlerSchedule",
        "glue:StopWorkflowRun",
        "glue:UpdateBlueprint",
        "glue:UpdateColumnStatisticsForPartition",
        "glue:UpdateColumnStatisticsForTable",
        "glue:UpdateConnection",
        "glue:UpdateCrawler",
        "glue:UpdateCrawlerSchedule",
        "glue:UpdateDatabase",
        "glue:UpdateJob",
        "glue:UpdatePartition",
        "glue:UpdateTable",
        "glue:UpdateWorkflow",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:List*",
        "iam:PassRole",
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:ListKeys",
        "kms:Verify",
        "kms:Sign",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:GetLogEvents",
        "logs:GetLogGroupFields",
        "logs:GetQueryResults",
        "logs:GetLogRecord",
        "logs:PutLogEvents",
        "logs:CreateLogStream",
        "logs:FilterLogEvents",
        "lakeformation:GetDataAccess",
        "lakeformation:GetDataLakeSettings",
        "lakeformation:GetResourceLFTags",
        "lakeformation:ListPermissions",
        "redshift-data:ListTables",
        "redshift-data:DescribeTable",
        "redshift-data:ListSchemas",
        "redshift-data:ListDatabases",
        "redshift-data:ExecuteStatement",
        "redshift-data:GetStatementResult",
        "redshift-data:DescribeStatement",
        "redshift:CreateClusterUser",
        "redshift:DescribeClusters",
        "redshift:DescribeDataShares",
        "redshift:GetClusterCredentials",
        "redshift:GetClusterCredentialsWithIAM",
        "redshift:JoinGroup",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListWorkgroups",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:GetCredentials",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:PutObject",
        "s3:PutObjectRetention",
        "s3:ReplicateObject",
        "s3:RestoreObject",
        "secretsmanager:CreateSecret",
        "secretsmanager:ListSecrets",
        "secretsmanager:TagResource",
        "tag:GetResources"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

Version history

Current version v4, edited by AWS on 2023-11-17. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary

Terraform

resource "aws_iam_role_policy_attachment" "amazondatazoneenvironmentrolepermissionsboundary" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonDataZoneEnvironmentRolePermissionsBoundary"),
);

Sources

Pending editorial review. No editorial sources are listed yet.