AmazonRedshiftDataFullAccess

Summary

Provides full access to the Amazon Redshift Data API and grants scoped access to other required services. The Amazon Redshift Management Guide says it grants full access to the Data API operations and resources for an AWS account.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccessCopy ARN

Default version

v5

Created

2020-09-09

Last edited

2023-04-07

Services

iam, redshift, redshift-data, redshift-serverless, secretsmanager

Control-plane actions (15)

By access level: 2 List, 6 Read, 7 Write.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

• redshift:CreateClusterUser (deny-conditional, statement 5): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 7 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Related policies

Same service

• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneRedshiftManageAccessRolePolicy
• AmazonGrafanaRedshiftAccess
• AmazonMachineLearningRoleforRedshiftDataSourceV3
• AmazonRedshiftFullAccess
• AmazonRedshiftQueryEditor
• AmazonRedshiftReadOnlyAccess

Same domain

• AmazonAthenaFullAccess
• AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy
• AmazonChimeSDKMessagingServiceRolePolicy
• AmazonDataZoneDomainExecutionRolePolicy
• AmazonDataZoneFullAccess
• AmazonDataZoneFullUserAccess
• AmazonDataZoneGlueManageAccessRolePolicy
• AmazonDataZoneRedshiftGlueProvisioningPolicy

Frequently asked questions

When should I attach AmazonRedshiftDataFullAccess?

Attach it to users, groups or roles that need full access to the Amazon Redshift Data API. The Amazon Redshift Management Guide also says to attach it, with AmazonEventBridgeFullAccess, to the IAM role that runs scheduled queries.

What does AmazonRedshiftDataFullAccess grant?

It allows ten Data API actions on all resources, and scoped access to secrets, temporary database credentials, and the Redshift service-linked role. It denies redshift:CreateClusterUser for the redshift_data_api_user database user.

What are the security risks of AmazonRedshiftDataFullAccess?

The Data API actions apply to all resources, and the policy lets holders obtain database credentials and read tagged secrets. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataAPIPermissions",
      "Effect": "Allow",
      "Action": [
        "redshift-data:BatchExecuteStatement",
        "redshift-data:ExecuteStatement",
        "redshift-data:CancelStatement",
        "redshift-data:ListStatements",
        "redshift-data:GetStatementResult",
        "redshift-data:DescribeStatement",
        "redshift-data:ListDatabases",
        "redshift-data:ListSchemas",
        "redshift-data:ListTables",
        "redshift-data:DescribeTable"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SecretsManagerPermissions",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:*",
      "Condition": {
        "StringLike": {
          "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*"
        }
      }
    },
    {
      "Sid": "GetCredentialsForAPIUser",
      "Effect": "Allow",
      "Action": "redshift:GetClusterCredentials",
      "Resource": [
        "arn:aws:redshift:*:*:dbname:*/*",
        "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user"
      ]
    },
    {
      "Sid": "GetCredentialsWithFederatedIAMCredentials",
      "Effect": "Allow",
      "Action": "redshift:GetClusterCredentialsWithIAM",
      "Resource": "arn:aws:redshift:*:*:dbname:*/*"
    },
    {
      "Sid": "GetCredentialsForServerless",
      "Effect": "Allow",
      "Action": "redshift-serverless:GetCredentials",
      "Resource": "arn:aws:redshift-serverless:*:*:workgroup/*",
      "Condition": {
        "StringLike": {
          "aws:ResourceTag/RedshiftDataFullAccess": "*"
        }
      }
    },
    {
      "Sid": "DenyCreateAPIUser",
      "Effect": "Deny",
      "Action": "redshift:CreateClusterUser",
      "Resource": [
        "arn:aws:redshift:*:*:dbuser:*/redshift_data_api_user"
      ]
    },
    {
      "Sid": "ServiceLinkedRole",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/redshift-data.amazonaws.com/AWSServiceRoleForRedshift",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "redshift-data.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v5, edited by AWS on 2023-04-07. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess

resource "aws_iam_role_policy_attachment" "amazonredshiftdatafullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRedshiftDataFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonRedshiftDataFullAccess"),
);

Sources

• AmazonRedshiftDataFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• Using identity-based policies (IAM policies) for Amazon Redshift (Amazon Redshift Management Guide) (retrieved 2026-11-13; supports summary, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AmazonRedshiftDataFullAccess
• AWS service guide
• Report a data issue