When should I attach AmazonSNSReadOnlyAccess?

The Amazon SNS Developer Guide says it provides read-only access to Amazon SNS using the AWS Management Console and that you can attach it to your users, groups and roles. Attach it where viewing SNS is the intended scope.

What does AmazonSNSReadOnlyAccess grant?

It allows sns:GetTopicAttributes, sns:List*, sns:CheckIfPhoneNumberIsOptedOut and several other sns:Get* actions on all resources, plus five sms-voice:Describe* actions that apply only when called through Amazon SNS.

What are the security risks of AmazonSNSReadOnlyAccess?

It has no publish, subscribe or delete action, but it can show SMS account details such as verified destination numbers, opted-out numbers and spend limits. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to.

AmazonSNSReadOnlyAccess

ReaderAWS managedActiveReviewedShow on map Compare

Summary

Provides read only access to Amazon SNS via the AWS Management Console. The policy also includes read-only actions for AWS End User Messaging SMS (sms-voice) that apply only when called through Amazon SNS.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess
Default version: v2
Created: 2015-02-06
Last edited: 2024-09-24
Services: sms-voice, sns

Control-plane actions (22)

By access level: 7 List, 15 Read.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Pinpoint SMS Voice	5 of 107	5 Read; 5 restricted, 5 conditional	sms-voice:DescribeAccountAttributes, sms-voice:DescribeOptedOutNumbers, sms-voice:DescribePhoneNumbers, sms-voice:DescribeSpendLimits, sms-voice:DescribeVerifiedDestinationNumbers
SNS	17 of 40	7 List, 10 Read; 0 restricted, 0 conditional	sns:CheckIfPhoneNumberIsOptedOut, sns:GetDataProtectionPolicy, sns:GetEndpointAttributes, sns:GetPlatformApplicationAttributes, sns:GetSMSAttributes, sns:GetSMSSandboxAccountStatus, sns:GetSubscriptionAttributes, sns:GetTopicAttributes, sns:List*

Pinpoint SMS Voice: 5 actions

sms-voice:DescribeAccountAttributes (Read)
sms-voice:DescribeOptedOutNumbers (Read)
sms-voice:DescribePhoneNumbers (Read)
sms-voice:DescribeSpendLimits (Read)
sms-voice:DescribeVerifiedDestinationNumbers (Read)

SNS: 17 actions

sns:CheckIfPhoneNumberIsOptedOut (Read)
sns:GetDataProtectionPolicy (Read)
sns:GetEndpointAttributes (Read)
sns:GetPlatformApplicationAttributes (Read)
sns:GetSMSAttributes (Read)
sns:GetSMSSandboxAccountStatus (Read)
sns:GetSubscriptionAttributes (Read)
sns:GetTopicAttributes (Read)
sns:ListEndpointsByPlatformApplication (List)
sns:ListOriginationNumbers (List)
sns:ListPhoneNumbersOptedOut (Read)
sns:ListPlatformApplications (List)
sns:ListSMSSandboxPhoneNumbers (List)
sns:ListSubscriptions (List)
sns:ListSubscriptionsByTopic (List)
sns:ListTagsForResource (Read)
sns:ListTopics (List)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants only List and Read actions.

Guidance

Practical scope

The first statement (SNSReadOnlyAccess) allows sns:GetTopicAttributes, sns:List*, sns:CheckIfPhoneNumberIsOptedOut, sns:GetEndpointAttributes, sns:GetDataProtectionPolicy, sns:GetPlatformApplicationAttributes, sns:GetSMSAttributes, sns:GetSMSSandboxAccountStatus and sns:GetSubscriptionAttributes on Resource "*". The second statement (SMSAccessViaSNS) allows sms-voice:Describe* actions on Resource "*" only when aws:CalledViaLast equals sns.amazonaws.com.

Use cases

Give users, groups or roles read-only access to Amazon SNS, including the read-only SMS actions available through Amazon SNS.

Best practices

AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

It lets a user view SMS account details, including verified destination numbers, phone numbers used for SMS messaging, opted-out numbers and spend limits, through sms-voice:Describe* actions called via Amazon SNS.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The Amazon SNS Developer Guide says you can attach it to your users, groups and roles. It fits where read-only access to Amazon SNS is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case.

Same service

Same domain

Frequently asked questions

When should I attach AmazonSNSReadOnlyAccess?: The Amazon SNS Developer Guide says it provides read-only access to Amazon SNS using the AWS Management Console and that you can attach it to your users, groups and roles. Attach it where viewing SNS is the intended scope.
What does AmazonSNSReadOnlyAccess grant?: It allows sns:GetTopicAttributes, sns:List*, sns:CheckIfPhoneNumberIsOptedOut and several other sns:Get* actions on all resources, plus five sms-voice:Describe* actions that apply only when called through Amazon SNS.
What are the security risks of AmazonSNSReadOnlyAccess?: It has no publish, subscribe or delete action, but it can show SMS account details such as verified destination numbers, opted-out numbers and spend limits. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SNSReadOnlyAccess",
      "Effect": "Allow",
      "Action": [
        "sns:GetTopicAttributes",
        "sns:List*",
        "sns:CheckIfPhoneNumberIsOptedOut",
        "sns:GetEndpointAttributes",
        "sns:GetDataProtectionPolicy",
        "sns:GetPlatformApplicationAttributes",
        "sns:GetSMSAttributes",
        "sns:GetSMSSandboxAccountStatus",
        "sns:GetSubscriptionAttributes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SMSAccessViaSNS",
      "Effect": "Allow",
      "Action": [
        "sms-voice:DescribeVerifiedDestinationNumbers",
        "sms-voice:DescribeAccountAttributes",
        "sms-voice:DescribeSpendLimits",
        "sms-voice:DescribePhoneNumbers",
        "sms-voice:DescribeOptedOutNumbers"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "sns.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v2, edited by AWS on 2024-09-24. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "amazonsnsreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSNSReadOnlyAccess"),
);

Sources

AmazonSNSReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
AWS managed policies for Amazon SNS (Amazon SNS Developer Guide) (retrieved 2026-11-12; supports summary, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)