AmazonODBReadOnlyAccess

ReaderAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides read-only access to Oracle Database@AWS resources

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess
Default version: v2
Created: 2026-08-07
Last edited: 2026-09-04
Services: ec2, odb

Control-plane actions (38)

By access level: 23 List, 15 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
EC2	2 of 834	2 List; 0 restricted, 0 conditional	ec2:DescribeAvailabilityZones, ec2:DescribeVpcs
Oracle Database@AWS	36 of 96	21 List, 15 Read; 0 restricted, 0 conditional	odb:GetAutonomousDatabase, odb:GetAutonomousDatabaseBackup, odb:GetCloudAutonomousVmCluster, odb:GetCloudExadataInfrastructure, odb:GetCloudExadataInfrastructureUnallocatedResources, odb:GetCloudVmCluster, odb:GetDbNode, odb:GetDbServer, odb:GetExadbVmCluster, odb:GetExascaleDbStorageVault, odb:GetOciOnboardingStatus, odb:GetOdbNetwork and 24 more

EC2: 2 actions

ec2:DescribeAvailabilityZones (List)
ec2:DescribeVpcs (List)

Oracle Database@AWS: 36 actions

odb:GetAutonomousDatabase (Read)
odb:GetAutonomousDatabaseBackup (Read)
odb:GetCloudAutonomousVmCluster (Read)
odb:GetCloudExadataInfrastructure (Read)
odb:GetCloudExadataInfrastructureUnallocatedResources (Read)
odb:GetCloudVmCluster (Read)
odb:GetDbNode (Read)
odb:GetDbServer (Read)
odb:GetExadbVmCluster (Read)
odb:GetExascaleDbStorageVault (Read)
odb:GetOciOnboardingStatus (Read)
odb:GetOdbNetwork (Read)
odb:GetOdbPeeringConnection (Read)
odb:GetResourcePolicy (Read)
odb:ListAutonomousDatabaseBackups (List)
odb:ListAutonomousDatabaseCharacterSets (List)
odb:ListAutonomousDatabaseClones (List)
odb:ListAutonomousDatabasePeers (List)
odb:ListAutonomousDatabaseVersions (List)
odb:ListAutonomousDatabases (List)
odb:ListAutonomousVirtualMachines (List)
odb:ListCloudAutonomousVmClusters (List)
odb:ListCloudExadataInfrastructures (List)
odb:ListCloudVmClusters (List)
odb:ListDbNodes (List)
odb:ListDbServers (List)
odb:ListDbSystemShapes (List)
odb:ListExadbVmClusters (List)
odb:ListExascaleDbStorageVaults (List)
odb:ListFlexComponents (List)
odb:ListGiMinorVersions (List)
odb:ListGiVersions (List)
odb:ListOdbNetworks (List)
odb:ListOdbPeeringConnections (List)
odb:ListSystemVersions (List)
odb:ListTagsForResource (Read)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowODBReads",
      "Effect": "Allow",
      "Action": [
        "odb:GetOciOnboardingStatus",
        "odb:GetCloudExadataInfrastructure",
        "odb:GetCloudExadataInfrastructureUnallocatedResources",
        "odb:ListCloudExadataInfrastructures",
        "odb:GetCloudVmCluster",
        "odb:ListCloudVmClusters",
        "odb:GetCloudAutonomousVmCluster",
        "odb:ListCloudAutonomousVmClusters",
        "odb:GetExascaleDbStorageVault",
        "odb:ListExascaleDbStorageVaults",
        "odb:GetExadbVmCluster",
        "odb:ListExadbVmClusters",
        "odb:ListGiMinorVersions",
        "odb:GetAutonomousDatabase",
        "odb:ListAutonomousDatabases",
        "odb:ListAutonomousDatabaseClones",
        "odb:ListAutonomousDatabasePeers",
        "odb:GetAutonomousDatabaseBackup",
        "odb:ListAutonomousDatabaseBackups",
        "odb:GetDbNode",
        "odb:ListDbNodes",
        "odb:GetDbServer",
        "odb:ListDbServers",
        "odb:GetOdbNetwork",
        "odb:ListOdbNetworks",
        "odb:GetOdbPeeringConnection",
        "odb:ListOdbPeeringConnections",
        "odb:ListAutonomousVirtualMachines",
        "odb:ListDbSystemShapes",
        "odb:ListFlexComponents",
        "odb:ListGiVersions",
        "odb:ListSystemVersions",
        "odb:ListAutonomousDatabaseVersions",
        "odb:ListAutonomousDatabaseCharacterSets",
        "odb:GetResourcePolicy",
        "odb:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowEC2Reads",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeVpcs"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v2, edited by AWS on 2026-09-04. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonodbreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonODBReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonODBReadOnlyAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.