AmazonEC2RoleforDataPipelineRole

High privilegeAdminService roleActivePermissions reviewedShow on map Compare

Summary

Default policy for the Amazon EC2 Role for Data Pipeline service role.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole
Default version: v3
Created: 2015-02-06
Last edited: 2016-02-22
Services: cloudwatch, datapipeline, dynamodb, ec2, elasticmapreduce, rds, redshift, s3, sdb, sns, sqs

Control-plane actions (738)

By access level: 300 List, 41 Permissions management, 169 Read, 18 Tagging, 210 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	All 160 actions (see the CloudWatch page)	24 List, 8 Permissions management, 46 Read, 2 Tagging, 80 Write; 0 restricted, 0 conditional	cloudwatch:*
Data Pipeline	All 21 actions (see the Data Pipeline page)	2 List, 6 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	datapipeline:*
DynamoDB	All 68 actions (see the DynamoDB page)	7 List, 3 Permissions management, 22 Read, 2 Tagging, 34 Write; 0 restricted, 0 conditional	dynamodb:*
EC2	195 of 834	195 List; 0 restricted, 0 conditional	ec2:Describe*
EMR	15 of 88	13 Read, 2 Write; 0 restricted, 0 conditional	elasticmapreduce:AddJobFlowSteps, elasticmapreduce:Describe, elasticmapreduce:ListInstance, elasticmapreduce:ModifyInstanceGroups
RDS	49 of 173	47 List, 2 Read; 0 restricted, 0 conditional	rds:Describe*
Redshift	2 of 167	1 List, 1 Read; 0 restricted, 0 conditional	redshift:DescribeClusterSecurityGroups, redshift:DescribeClusters
S3	All 155 actions (see the S3 page)	15 List, 24 Permissions management, 58 Read, 8 Tagging, 50 Write; 0 restricted, 0 conditional	s3:*
SimpleDB	All 13 actions (see the SimpleDB page)	2 List, 4 Read, 7 Write; 0 restricted, 0 conditional	sdb:*
SNS	All 40 actions (see the SNS page)	7 List, 3 Permissions management, 10 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	sns:*
SQS	All 20 actions (see the SQS page)	3 Permissions management, 7 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	sqs:*

EC2: 195 actions

ec2:DescribeAccountAttributes (List)
ec2:DescribeAccountVpcEncryptionControl (List)
ec2:DescribeAddressTransfers (List)
ec2:DescribeAddresses (List)
ec2:DescribeAddressesAttribute (List)
ec2:DescribeAggregateIdFormat (List)
ec2:DescribeApplicationStatus (List)
ec2:DescribeApplicationStatusCheckAssociations (List)
ec2:DescribeApplicationStatusChecks (List)
ec2:DescribeAvailabilityZones (List)
ec2:DescribeAwsNetworkPerformanceMetricSubscriptions (List)
ec2:DescribeBundleTasks (List)
ec2:DescribeByoipCidrs (List)
ec2:DescribeCapacityBlockExtensionHistory (List)
ec2:DescribeCapacityBlockExtensionOfferings (List)
ec2:DescribeCapacityBlockOfferings (List)
ec2:DescribeCapacityBlockStatus (List)
ec2:DescribeCapacityBlocks (List)
ec2:DescribeCapacityManagerDataExports (List)
ec2:DescribeCapacityReservationBillingRequests (List)
ec2:DescribeCapacityReservationCancellationQuotes (List)
ec2:DescribeCapacityReservationDateChangeQuotes (List)
ec2:DescribeCapacityReservationFleets (List)
ec2:DescribeCapacityReservationTopology (List)
ec2:DescribeCapacityReservations (List)
ec2:DescribeCarrierGateways (List)
ec2:DescribeClassicLinkInstances (List)
ec2:DescribeClientVpnAuthorizationRules (List)
ec2:DescribeClientVpnConnections (List)
ec2:DescribeClientVpnEndpoints (List)
ec2:DescribeClientVpnRoutes (List)
ec2:DescribeClientVpnTargetNetworks (List)
ec2:DescribeCoipPools (List)
ec2:DescribeConversionTasks (List)
ec2:DescribeCustomerGateways (List)
ec2:DescribeDeclarativePoliciesReports (List)
ec2:DescribeDhcpOptions (List)
ec2:DescribeEgressOnlyInternetGateways (List)
ec2:DescribeElasticGpus (List)
ec2:DescribeExportImageTasks (List)
ec2:DescribeExportTasks (List)
ec2:DescribeFastLaunchImages (List)
ec2:DescribeFastSnapshotRestores (List)
ec2:DescribeFleetHistory (List)
ec2:DescribeFleetInstances (List)
ec2:DescribeFleets (List)
ec2:DescribeFlowLogs (List)
ec2:DescribeFpgaImageAttribute (List)
ec2:DescribeFpgaImages (List)
ec2:DescribeHostReservationOfferings (List)
ec2:DescribeHostReservations (List)
ec2:DescribeHosts (List)
ec2:DescribeIamInstanceProfileAssociations (List)
ec2:DescribeIdFormat (List)
ec2:DescribeIdentityIdFormat (List)
ec2:DescribeImageAttribute (List)
ec2:DescribeImageReferences (List)
ec2:DescribeImageUsageReportEntries (List)
ec2:DescribeImageUsageReports (List)
ec2:DescribeImages (List)
ec2:DescribeImportImageTasks (List)
ec2:DescribeImportSnapshotTasks (List)
ec2:DescribeInstanceAttribute (List)
ec2:DescribeInstanceConnectEndpoints (List)
ec2:DescribeInstanceCreditSpecifications (List)
ec2:DescribeInstanceEventNotificationAttributes (List)
ec2:DescribeInstanceEventWindows (List)
ec2:DescribeInstanceImageMetadata (List)
ec2:DescribeInstanceSqlHaHistoryStates (List)
ec2:DescribeInstanceSqlHaStates (List)
ec2:DescribeInstanceStatus (List)
ec2:DescribeInstanceTopology (List)
ec2:DescribeInstanceTypeOfferings (List)
ec2:DescribeInstanceTypes (List)
ec2:DescribeInstances (List)
ec2:DescribeInternetGateways (List)
ec2:DescribeIpamByoasn (List)
ec2:DescribeIpamExternalResourceVerificationTokens (List)
ec2:DescribeIpamInternetRegistryAssociations (List)
ec2:DescribeIpamPolicies (List)
ec2:DescribeIpamPoolAllocations (List)
ec2:DescribeIpamPools (List)
ec2:DescribeIpamPrefixListResolverTargets (List)
ec2:DescribeIpamPrefixListResolvers (List)
ec2:DescribeIpamResourceDiscoveries (List)
ec2:DescribeIpamResourceDiscoveryAssociations (List)
ec2:DescribeIpamScopes (List)
ec2:DescribeIpams (List)
ec2:DescribeIpv6Pools (List)
ec2:DescribeKeyPairs (List)
ec2:DescribeLaunchTemplateVersions (List)
ec2:DescribeLaunchTemplates (List)
ec2:DescribeLocalGatewayRouteTablePermissions (List)
ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations (List)
ec2:DescribeLocalGatewayRouteTableVpcAssociations (List)
ec2:DescribeLocalGatewayRouteTables (List)
ec2:DescribeLocalGatewayVirtualInterfaceGroups (List)
ec2:DescribeLocalGatewayVirtualInterfaces (List)
ec2:DescribeLocalGateways (List)
ec2:DescribeLockedSnapshots (List)
ec2:DescribeMacHosts (List)
ec2:DescribeMacModificationTasks (List)
ec2:DescribeManagedPrefixLists (List)
ec2:DescribeMovingAddresses (List)
ec2:DescribeNatGateways (List)
ec2:DescribeNetworkAcls (List)
ec2:DescribeNetworkInsightsAccessScopeAnalyses (List)
ec2:DescribeNetworkInsightsAccessScopes (List)
ec2:DescribeNetworkInsightsAnalyses (List)
ec2:DescribeNetworkInsightsPaths (List)
ec2:DescribeNetworkInterfaceAttribute (List)
ec2:DescribeNetworkInterfacePermissions (List)
ec2:DescribeNetworkInterfaces (List)
ec2:DescribeOutpostLags (List)
ec2:DescribePlacementGroups (List)
ec2:DescribePrefixLists (List)
ec2:DescribePrincipalIdFormat (List)
ec2:DescribePublicIpv4Pools (List)
ec2:DescribeRegions (List)
ec2:DescribeReplaceRootVolumeTasks (List)
ec2:DescribeReservedInstances (List)
ec2:DescribeReservedInstancesListings (List)
ec2:DescribeReservedInstancesModifications (List)
ec2:DescribeReservedInstancesOfferings (List)
ec2:DescribeRouteServerEndpoints (List)
ec2:DescribeRouteServerPeers (List)
ec2:DescribeRouteServers (List)
ec2:DescribeRouteTables (List)
ec2:DescribeScheduledInstanceAvailability (List)
ec2:DescribeScheduledInstances (List)
ec2:DescribeSecondaryInterfaces (List)
ec2:DescribeSecondaryNetworks (List)
ec2:DescribeSecondarySubnets (List)
ec2:DescribeSecurityGroupReferences (List)
ec2:DescribeSecurityGroupRules (List)
ec2:DescribeSecurityGroupVpcAssociations (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeServiceLinkVirtualInterfaces (List)
ec2:DescribeSnapshotAttribute (List)
ec2:DescribeSnapshotTierStatus (List)
ec2:DescribeSnapshots (List)
ec2:DescribeSpotDatafeedSubscription (List)
ec2:DescribeSpotFleetInstances (List)
ec2:DescribeSpotFleetRequestHistory (List)
ec2:DescribeSpotFleetRequests (List)
ec2:DescribeSpotInstanceRequests (List)
ec2:DescribeSpotPriceHistory (List)
ec2:DescribeStaleSecurityGroups (List)
ec2:DescribeStoreImageTasks (List)
ec2:DescribeSubnets (List)
ec2:DescribeTags (List)
ec2:DescribeTrafficMirrorFilterRules (List)
ec2:DescribeTrafficMirrorFilters (List)
ec2:DescribeTrafficMirrorSessions (List)
ec2:DescribeTrafficMirrorTargets (List)
ec2:DescribeTransitGatewayAttachments (List)
ec2:DescribeTransitGatewayConnectPeers (List)
ec2:DescribeTransitGatewayConnects (List)
ec2:DescribeTransitGatewayMeteringPolicies (List)
ec2:DescribeTransitGatewayMulticastDomains (List)
ec2:DescribeTransitGatewayPeeringAttachments (List)
ec2:DescribeTransitGatewayPolicyTables (List)
ec2:DescribeTransitGatewayRouteTableAnnouncements (List)
ec2:DescribeTransitGatewayRouteTables (List)
ec2:DescribeTransitGatewayVpcAttachments (List)
ec2:DescribeTransitGateways (List)
ec2:DescribeTrunkInterfaceAssociations (List)
ec2:DescribeVerifiedAccessEndpoints (List)
ec2:DescribeVerifiedAccessGroups (List)
ec2:DescribeVerifiedAccessInstanceLoggingConfigurations (List)
ec2:DescribeVerifiedAccessInstanceWebAclAssociations (List)
ec2:DescribeVerifiedAccessInstances (List)
ec2:DescribeVerifiedAccessTrustProviders (List)
ec2:DescribeVolumeAttribute (List)
ec2:DescribeVolumeStatus (List)
ec2:DescribeVolumes (List)
ec2:DescribeVolumesModifications (List)
ec2:DescribeVpcAttribute (List)
ec2:DescribeVpcBlockPublicAccessExclusions (List)
ec2:DescribeVpcBlockPublicAccessOptions (List)
ec2:DescribeVpcClassicLink (List)
ec2:DescribeVpcClassicLinkDnsSupport (List)
ec2:DescribeVpcEncryptionControls (List)
ec2:DescribeVpcEndpointAssociations (List)
ec2:DescribeVpcEndpointConnectionNotifications (List)
ec2:DescribeVpcEndpointConnections (List)
ec2:DescribeVpcEndpointServiceConfigurations (List)
ec2:DescribeVpcEndpointServicePermissions (List)
ec2:DescribeVpcEndpointServices (List)
ec2:DescribeVpcEndpoints (List)
ec2:DescribeVpcPeeringConnections (List)
ec2:DescribeVpcs (List)
ec2:DescribeVpnConcentrators (List)
ec2:DescribeVpnConnections (List)
ec2:DescribeVpnGateways (List)

EMR: 15 actions

elasticmapreduce:AddJobFlowSteps (Write)
elasticmapreduce:DescribeCluster (Read)
elasticmapreduce:DescribeEditor (Read)
elasticmapreduce:DescribeJobFlows (Read)
elasticmapreduce:DescribeNotebookExecution (Read)
elasticmapreduce:DescribePersistentAppUI (Read)
elasticmapreduce:DescribeReleaseLabel (Read)
elasticmapreduce:DescribeRepository (Read)
elasticmapreduce:DescribeSecurityConfiguration (Read)
elasticmapreduce:DescribeStep (Read)
elasticmapreduce:DescribeStudio (Read)
elasticmapreduce:ListInstanceFleets (Read)
elasticmapreduce:ListInstanceGroups (Read)
elasticmapreduce:ListInstances (Read)
elasticmapreduce:ModifyInstanceGroups (Write)

RDS: 49 actions

rds:DescribeAccountAttributes (List)
rds:DescribeBlueGreenDeployments (List)
rds:DescribeCertificates (List)
rds:DescribeDBCapacityReservations (List)
rds:DescribeDBClusterAutomatedBackups (List)
rds:DescribeDBClusterBacktracks (List)
rds:DescribeDBClusterEndpoints (List)
rds:DescribeDBClusterParameterGroups (List)
rds:DescribeDBClusterParameters (List)
rds:DescribeDBClusterSnapshotAttributes (List)
rds:DescribeDBClusterSnapshots (List)
rds:DescribeDBClusters (List)
rds:DescribeDBEngineVersions (List)
rds:DescribeDBInstanceAutomatedBackups (List)
rds:DescribeDBInstances (List)
rds:DescribeDBLogFiles (List)
rds:DescribeDBMajorEngineVersions (List)
rds:DescribeDBParameterGroups (List)
rds:DescribeDBParameters (List)
rds:DescribeDBProxies (List)
rds:DescribeDBProxyEndpoints (List)
rds:DescribeDBProxyTargetGroups (List)
rds:DescribeDBProxyTargets (List)
rds:DescribeDBRecommendations (List)
rds:DescribeDBSecurityGroups (List)
rds:DescribeDBShardGroups (List)
rds:DescribeDBSnapshotAttributes (List)
rds:DescribeDBSnapshotTenantDatabases (List)
rds:DescribeDBSnapshots (List)
rds:DescribeDBSubnetGroups (List)
rds:DescribeEngineDefaultClusterParameters (List)
rds:DescribeEngineDefaultParameters (List)
rds:DescribeEventCategories (List)
rds:DescribeEventSubscriptions (List)
rds:DescribeEvents (List)
rds:DescribeExportTasks (List)
rds:DescribeGlobalClusters (List)
rds:DescribeIntegrations (List)
rds:DescribeOptionGroupOptions (List)
rds:DescribeOptionGroups (List)
rds:DescribeOrderableDBInstanceOptions (List)
rds:DescribePendingMaintenanceActions (List)
rds:DescribeRecommendationGroups (Read)
rds:DescribeRecommendations (Read)
rds:DescribeReservedDBInstances (List)
rds:DescribeReservedDBInstancesOfferings (List)
rds:DescribeSourceRegions (List)
rds:DescribeTenantDatabases (List)
rds:DescribeValidDBInstanceModifications (List)

Redshift: 2 actions

redshift:DescribeClusterSecurityGroups (Read)
redshift:DescribeClusters (List)

Data-plane actions (48)

By access level: 4 List, 3 Permissions management, 20 Read, 4 Tagging, 17 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	All 5 actions (see the CloudWatch page)	1 List, 3 Read, 1 Write; 0 restricted, 0 conditional	cloudwatch:*
DynamoDB	All 17 actions (see the DynamoDB page)	9 Read, 8 Write; 0 restricted, 0 conditional	dynamodb:*
S3	All 25 actions (see the S3 page)	3 List, 3 Permissions management, 8 Read, 4 Tagging, 7 Write; 0 restricted, 0 conditional	s3:*
SNS	All 1 actions (see the SNS page)	1 Write; 0 restricted, 0 conditional	sns:*

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: cloudwatch (89 of 89), datapipeline (11 of 11), dynamodb (45 of 45), s3 (84 of 84), sdb (7 of 7), sns (22 of 22), sqs (11 of 11).
Grants data-plane write actions on a data store on all resources without conditions.
27 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:*",
        "datapipeline:*",
        "dynamodb:*",
        "ec2:Describe*",
        "elasticmapreduce:AddJobFlowSteps",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:ListInstance*",
        "elasticmapreduce:ModifyInstanceGroups",
        "rds:Describe*",
        "redshift:DescribeClusters",
        "redshift:DescribeClusterSecurityGroups",
        "s3:*",
        "sdb:*",
        "sns:*",
        "sqs:*"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

Version history

Current version v3, edited by AWS on 2016-02-22. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole

Terraform

resource "aws_iam_role_policy_attachment" "service_role_amazonec2rolefordatapipelinerole" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonEC2RoleforDataPipelineRole"),
);

Sources

Pending editorial review. No editorial sources are listed yet.