AmazonKeyspacesReadOnlyAccess_v2

Summary

Provides read only access to Amazon Keyspaces and related AWS services. The Amazon Keyspaces (for Apache Cassandra) Developer Guide says it also includes the permissions needed when connecting through private VPC endpoints.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2Copy ARN

Default version

v4

Created

2023-09-12

Last edited

2026-02-12

Services

application-autoscaling, cassandra, cloudwatch, ec2, kms

Control-plane actions (12)

By access level: 4 List, 8 Read.

Data-plane actions (3)

By access level: 3 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AgentRegistryFullAccess
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppFlowFullAccess
• AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy
• AmazonAppStreamFullAccess
• AmazonAppStreamServiceAccess
• AmazonAthenaServiceRolePolicy

Same domain

• AmazonAuroraDSQLConsoleFullAccess
• AmazonAuroraDSQLFullAccess
• AmazonAuroraDSQLReadOnlyAccess
• AmazonDocDBConsoleFullAccess
• AmazonDocDBElasticFullAccess
• AmazonDocDBElasticReadOnlyAccess
• AmazonDocDBFullAccess
• AmazonDocDBReadOnlyAccess

Frequently asked questions

When should I attach AmazonKeyspacesReadOnlyAccess_v2?

The Amazon Keyspaces (for Apache Cassandra) Developer Guide describes it as read-only access to Amazon Keyspaces that includes the permissions required when connecting through private VPC endpoints. Attach it to users who need to read and view but not administer.

What does AmazonKeyspacesReadOnlyAccess_v2 grant?

It allows cassandra:Select, ListStreams, GetStream, GetShardIterator and GetRecords; Application Auto Scaling describe actions; cloudwatch:DescribeAlarms and GetMetricData; kms:DescribeKey and ListAliases; and ec2:DescribeNetworkInterfaces and DescribeVpcEndpoints, all on all resources.

What are the security risks of AmazonKeyspacesReadOnlyAccess_v2?

The policy has no write actions, but its read actions, including cassandra:Select and CDC stream reads, apply to all resources. AWS managed policies might not grant least-privilege permissions for your use case, and AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cassandra:Select",
        "cassandra:ListStreams",
        "cassandra:GetStream",
        "cassandra:GetShardIterator",
        "cassandra:GetRecords"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:DescribeScheduledActions",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricData",
        "kms:DescribeKey",
        "kms:ListAliases"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeVpcEndpoints"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2

resource "aws_iam_role_policy_attachment" "amazonkeyspacesreadonlyaccess_v2" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonKeyspacesReadOnlyAccess_v2"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonKeyspacesReadOnlyAccess_v2"),
);

Sources

• AmazonKeyspacesReadOnlyAccess_v2 (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for Amazon Keyspaces (Amazon Keyspaces (for Apache Cassandra) Developer Guide) (retrieved 2026-11-13; supports summary, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonKeyspacesReadOnlyAccess_v2
• AWS service guide
• Report a data issue