Skip to main content
IAM Policy Map

AmazonKeyspacesReadOnlyAccess

ReaderAWS managedActiveReviewedShow on mapCompare

Summary

Provides read only access to Amazon Keyspaces. The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities and that it includes view access to CDC streams, Application Auto Scaling configurations, CloudWatch metrics and alarms, and AWS KMS keys.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess
Default version
v6
Created
Last edited
Services
application-autoscaling, cassandra, cloudwatch, kms

Control-plane actions (10)

By access level: 2 List, 8 Read.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Application Auto Scaling4 of 144 Read; 0 restricted, 0 conditionalapplication-autoscaling:DescribeScalableTargets, application-autoscaling:DescribeScalingActivities, application-autoscaling:DescribeScalingPolicies, application-autoscaling:DescribeScheduledActions
Keyspaces3 of 191 List, 2 Read; 0 restricted, 0 conditionalcassandra:GetStream, cassandra:ListStreams, cassandra:Select
CloudWatch1 of 1601 Read; 0 restricted, 0 conditionalcloudwatch:DescribeAlarms
KMS2 of 581 List, 1 Read; 0 restricted, 0 conditionalkms:DescribeKey, kms:ListAliases
Application Auto Scaling: 4 actions
  • application-autoscaling:DescribeScalableTargets (Read)
  • application-autoscaling:DescribeScalingActivities (Read)
  • application-autoscaling:DescribeScalingPolicies (Read)
  • application-autoscaling:DescribeScheduledActions (Read)
Keyspaces: 3 actions
  • cassandra:GetStream (Read)
  • cassandra:ListStreams (List)
  • cassandra:Select (Read)
CloudWatch: 1 actions
  • cloudwatch:DescribeAlarms (Read)
KMS: 2 actions
  • kms:DescribeKey (Read)
  • kms:ListAliases (List)

Data-plane actions (3)

By access level: 3 Read.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
KeyspacesAll 2 actions (see the Keyspaces page)2 Read; 0 restricted, 0 conditionalcassandra:GetRecords, cassandra:GetShardIterator
CloudWatch1 of 51 Read; 0 restricted, 0 conditionalcloudwatch:GetMetricData
CloudWatch: 1 actions
  • cloudwatch:GetMetricData (Read)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants only List and Read actions.

Guidance

Practical scope

The first statement allows cassandra:Select, cassandra:ListStreams, cassandra:GetStream, cassandra:GetShardIterator and cassandra:GetRecords on Resource "*". The second statement allows application-autoscaling:DescribeScalableTargets, DescribeScalingActivities, DescribeScalingPolicies and DescribeScheduledActions, cloudwatch:DescribeAlarms, cloudwatch:GetMetricData, kms:DescribeKey and kms:ListAliases on Resource "*". It has no create, update or delete actions.

Use cases

  • Let users view Amazon Keyspaces, its CDC streams, the automatic scaling policies attached to a table, CloudWatch metrics and alarms for a table, and the KMS keys used with Keyspaces, without changing them.

Best practices

  • AWS managed policies might not grant least-privilege permissions for your use case. The service guide recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

  • The guide describes the policy as read only, but it applies to Resource "*" and includes cassandra:Select, cassandra:GetShardIterator and cassandra:GetRecords as well as read actions for Application Auto Scaling, CloudWatch and AWS KMS.
  • You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities. It fits where read-only access to Keyspaces is intended.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach AmazonKeyspacesReadOnlyAccess?
The Amazon Keyspaces Developer Guide says you can attach it to your IAM identities and that it grants read-only access to Amazon Keyspaces. Attach it where viewing Keyspaces, without changing it, is the intended scope.
What does AmazonKeyspacesReadOnlyAccess grant?
On all resources it allows cassandra:Select and four CDC stream read actions, four Application Auto Scaling Describe actions, cloudwatch:DescribeAlarms and cloudwatch:GetMetricData, and kms:DescribeKey and kms:ListAliases.
What are the security risks of AmazonKeyspacesReadOnlyAccess?
The policy grants no write actions, but it applies to all resources and includes cassandra:Select and CDC stream read actions. AWS managed policies might not grant least-privilege permissions, and an AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cassandra:Select",
        "cassandra:ListStreams",
        "cassandra:GetStream",
        "cassandra:GetShardIterator",
        "cassandra:GetRecords"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:DescribeScheduledActions",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricData",
        "kms:DescribeKey",
        "kms:ListAliases"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v6, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonkeyspacesreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonKeyspacesReadOnlyAccess"),
);

Sources