AmazonRedshiftFullAccess

Summary

Provides full access to Amazon Redshift via the AWS Management Console. The Amazon Redshift Management Guide says it grants full access to all Amazon Redshift resources for an account, and full access to Amazon Redshift Serverless resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AmazonRedshiftFullAccessCopy ARN

Default version

v5

Created

2015-02-06

Last edited

2022-07-07

Services

cloudwatch, ec2, iam, redshift, redshift-data, redshift-serverless, secretsmanager, sns, tag

Control-plane actions (347)

By access level: 74 List, 13 Permissions management, 116 Read, 7 Tagging, 137 Write.

Data-plane actions (4)

By access level: 1 List, 3 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: redshift (107 of 107), redshift-serverless (35 of 35).
• 10 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.

Guidance

Related policies

Same service

• AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy
• AmazonAthenaServiceRolePolicy
• AmazonAuroraDSQLReadOnlyAccess
• AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy
• AmazonCloudWatchEvidentlyFullAccess
• AmazonCloudWatchRUMReadOnlyAccess
• AmazonCloudWatchRUMServiceRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary

Same domain

• AmazonAthenaFullAccess
• AmazonChimeSDKMessagingServiceRolePolicy
• AmazonDataZoneDomainExecutionRolePolicy
• AmazonDataZoneFullAccess
• AmazonDataZoneFullUserAccess
• AmazonDataZoneGlueManageAccessRolePolicy
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneRedshiftGlueProvisioningPolicy

Frequently asked questions

When should I attach AmazonRedshiftFullAccess?

The reference page says you can attach AmazonRedshiftFullAccess to your users, groups and roles, and describes it as: provides full access to Amazon Redshift via the AWS Management Console. Attach it where full access to Amazon Redshift and Redshift Serverless is the intended scope.

What does AmazonRedshiftFullAccess grant?

It allows redshift:* and redshift-serverless:* on all resources, EC2 describe, SNS, CloudWatch and tag actions, the redshift-data actions, creation of the Redshift service-linked role, and Secrets Manager actions (ListSecrets on all resources; CreateSecret, GetSecretValue and TagResource under a resource tag condition).

What are the security risks of AmazonRedshiftFullAccess?

redshift:* and redshift-serverless:* allow every action in those services, the policy can run SQL through redshift-data:ExecuteStatement, and it can read secret values for secrets tagged RedshiftDataFullAccess. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "redshift:*",
        "redshift-serverless:*",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:DescribeInternetGateways",
        "sns:CreateTopic",
        "sns:Get*",
        "sns:List*",
        "cloudwatch:Describe*",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:EnableAlarmActions",
        "cloudwatch:DisableAlarmActions",
        "tag:GetResources",
        "tag:UntagResources",
        "tag:GetTagValues",
        "tag:GetTagKeys",
        "tag:TagResources"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "redshift.amazonaws.com"
        }
      }
    },
    {
      "Sid": "DataAPIPermissions",
      "Action": [
        "redshift-data:ExecuteStatement",
        "redshift-data:CancelStatement",
        "redshift-data:ListStatements",
        "redshift-data:GetStatementResult",
        "redshift-data:DescribeStatement",
        "redshift-data:ListDatabases",
        "redshift-data:ListSchemas",
        "redshift-data:ListTables",
        "redshift-data:DescribeTable"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "SecretsManagerListPermissions",
      "Action": [
        "secretsmanager:ListSecrets"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "SecretsManagerCreateGetPermissions",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:TagResource"
      ],
      "Effect": "Allow",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "secretsmanager:ResourceTag/RedshiftDataFullAccess": "*"
        }
      }
    }
  ]
}

Version history

Current version v5, edited by AWS on 2022-07-07. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonRedshiftFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonRedshiftFullAccess

resource "aws_iam_role_policy_attachment" "amazonredshiftfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonRedshiftFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonRedshiftFullAccess"),
);

Sources

• AmazonRedshiftFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• Using identity-based policies (IAM policies) for Amazon Redshift (Amazon Redshift Management Guide) (retrieved 2026-11-13; supports summary, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for AmazonRedshiftFullAccess
• AWS service guide
• Report a data issue