Skip to main content
IAM Policy Map

AssuranceServiceRolePolicy

OperatorService-linked roleActivePermissions reviewedShow on mapCompare

Summary

Allows AWS Assurance to access your resources for compliance assessments and evidence collection.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN
arn:aws:iam::aws:policy/aws-service-role/AssuranceServiceRolePolicy
Default version
v5
Created
Last edited
Services
access-analyzer, acm, acm-pca, amplify, aoss, apigateway, app-integrations, appconfig, appflow, application-signals, apprunner, appstream, appsync, aps, arc-zonal-shift, assurance, athena, auditmanager, autoscaling, b2bi, backup, backup-gateway, batch, bcm-data-exports, bedrock, bedrock-agentcore, budgets, ce, cleanrooms, cleanrooms-ml, cloud9, cloudformation, cloudfront, cloudtrail, cloudwatch, codeartifact, codebuild, codecommit, codedeploy, codeguru-profiler, codeguru-reviewer, codepipeline, cognito-identity, cognito-idp, comprehend, config, connect, connect-campaigns, databrew, datasync, dax, deadline, detective, devicefarm, dms, ds, dsql, dynamodb, ec2, ecr, ecs, eks, elasticache, elasticbeanstalk, elasticfilesystem, elasticloadbalancing, elasticmapreduce, emr-containers, emr-serverless, entityresolution, es, events, firehose, fis, forecast, frauddetector, gamelift, geo, globalaccelerator, glue, grafana, greengrass, groundstation, guardduty, iam, identitystore, imagebuilder, inspector2, internetmonitor, iot, iotdeviceadvisor, iotfleetwise, iotsitewise, iottwinmaker, iotwireless, ivs, kafka, kafkaconnect, kendra, kinesis, kinesisanalytics, kinesisvideo, kms, lakeformation, lambda, lex, license-manager, lightsail, logs, m2, macie2, mediaconnect, medialive, mediapackage-vod, mediapackagev2, mediatailor, memorydb, mq, network-firewall, networkmanager, omics, organizations, payment-cryptography, pca-connector-ad, pca-connector-scep, personalize, profile, qbusiness, quicksight, ram, rds, redshift, rekognition, resiliencehub, resource-explorer-2, resource-groups, rolesanywhere, route53, route53-recovery-control-config, route53-recovery-readiness, route53profiles, route53resolver, rum, s3, s3express, s3tables, s3vectors, sagemaker, scheduler, schemas, secretsmanager, securityhub, servicecatalog, servicediscovery, ses, shield, signer, sns, sqs, ssm, ssm-contacts, ssm-incidents, ssm-quicksetup, sso, states, tag, timestream, transfer, verifiedpermissions, wafv2

Control-plane actions (1652)

By access level: 793 List, 847 Read, 12 Write.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Access Analyzer3 of 372 List, 1 Read; 3 restricted, 3 conditionalaccess-analyzer:GetAnalyzer, access-analyzer:ListAnalyzers, access-analyzer:ListArchiveRules
Certificate Manager3 of 421 List, 2 Read; 3 restricted, 3 conditionalacm:DescribeCertificate, acm:ListCertificates, acm:ListTagsForCertificate
Private Certificate Authority5 of 231 List, 4 Read; 5 restricted, 5 conditionalacm-pca:DescribeCertificateAuthority, acm-pca:GetCertificateAuthorityCertificate, acm-pca:GetCertificateAuthorityCsr, acm-pca:ListCertificateAuthorities, acm-pca:ListTags
Amplify5 of 412 List, 3 Read; 5 restricted, 5 conditionalamplify:GetApp, amplify:GetBranch, amplify:ListApps, amplify:ListBranches, amplify:ListTagsForResource
OpenSearch Serverless13 of 577 List, 6 Read; 13 restricted, 13 conditionalaoss:BatchGetCollection, aoss:BatchGetLifecyclePolicy, aoss:BatchGetVpcEndpoint, aoss:GetAccessPolicy, aoss:GetSecurityConfig, aoss:GetSecurityPolicy, aoss:ListAccessPolicies, aoss:ListCollections, aoss:ListLifecyclePolicies, aoss:ListSecurityConfigs, aoss:ListSecurityPolicies, aoss:ListTagsForResource and 1 more
API Gateway1 of 441 Read; 1 restricted, 1 conditionalapigateway:GET
AppIntegrations7 of 353 List, 4 Read; 7 restricted, 7 conditionalapp-integrations:GetApplication, app-integrations:GetDataIntegration, app-integrations:GetEventIntegration, app-integrations:ListApplications, app-integrations:ListDataIntegrations, app-integrations:ListEventIntegrations, app-integrations:ListTagsForResource
AppConfig12 of 566 List, 6 Read; 12 restricted, 12 conditionalappconfig:GetConfigurationProfile, appconfig:GetDeploymentStrategy, appconfig:GetEnvironment, appconfig:GetExtension, appconfig:GetExtensionAssociation, appconfig:ListConfigurationProfiles, appconfig:ListDeploymentStrategies, appconfig:ListEnvironments, appconfig:ListExtensionAssociations, appconfig:ListExtensions, appconfig:ListHostedConfigurationVersions, appconfig:ListTagsForResource
AppFlow3 of 311 List, 2 Read; 3 restricted, 3 conditionalappflow:DescribeFlow, appflow:ListFlows, appflow:ListTagsForResource
Application Signals4 of 302 List, 2 Read; 4 restricted, 4 conditionalapplication-signals:GetServiceLevelObjective, application-signals:ListServiceLevelObjectiveExclusionWindows, application-signals:ListServiceLevelObjectives, application-signals:ListTagsForResource
App Runner4 of 422 List, 2 Read; 4 restricted, 4 conditionalapprunner:DescribeService, apprunner:DescribeVpcConnector, apprunner:ListServices, apprunner:ListVpcConnectors
AppStream 2.06 of 905 List, 1 Read; 6 restricted, 6 conditionalappstream:DescribeAppBlockBuilders, appstream:DescribeAppBlocks, appstream:DescribeDirectoryConfigs, appstream:DescribeFleets, appstream:DescribeStacks, appstream:ListTagsForResource
AppSync8 of 873 List, 5 Read; 8 restricted, 8 conditionalappsync:GetApi, appsync:GetApiCache, appsync:GetDataSource, appsync:GetGraphqlApi, appsync:ListApis, appsync:ListDataSources, appsync:ListGraphqlApis, appsync:ListTagsForResource
AMP9 of 612 List, 7 Read; 9 restricted, 9 conditionalaps:DescribeAlertManagerDefinition, aps:DescribeLoggingConfiguration, aps:DescribeQueryLoggingConfiguration, aps:DescribeRuleGroupsNamespace, aps:DescribeWorkspace, aps:DescribeWorkspaceConfiguration, aps:ListRuleGroupsNamespaces, aps:ListTagsForResource, aps:ListWorkspaces
ARC Zonal Shift1 of 151 Read; 1 restricted, 1 conditionalarc-zonal-shift:GetAutoshiftObserverNotificationStatus
Assurance33 of 9625 Read, 8 Write; 33 restricted, 0 conditionalassurance:BatchGetComment, assurance:BatchGetControl, assurance:BatchGetTask, assurance:CreateAnnotation, assurance:CreateComment, assurance:CreateTask, assurance:DeleteAnnotation, assurance:GetAssessment, assurance:GetComment, assurance:GetControl, assurance:GetControlStatus, assurance:GetEnvironment and 21 more
Athena7 of 863 List, 4 Read; 7 restricted, 7 conditionalathena:GetDataCatalog, athena:GetPreparedStatement, athena:GetWorkGroup, athena:ListDataCatalogs, athena:ListPreparedStatements, athena:ListTagsForResource, athena:ListWorkGroups
Audit Manager3 of 621 List, 2 Read; 3 restricted, 3 conditionalauditmanager:GetAssessment, auditmanager:ListAssessments, auditmanager:ListTagsForResource
EC2 Auto Scaling22 of 6821 List, 1 Read; 22 restricted, 22 conditionalautoscaling:DescribeAccountLimits, autoscaling:DescribeAccountSettings, autoscaling:DescribeAdjustmentTypes, autoscaling:DescribeAutoScalingGroups, autoscaling:DescribeAutoScalingInstances, autoscaling:DescribeAutoScalingNotificationTypes, autoscaling:DescribeInstanceRefreshes, autoscaling:DescribeLaunchConfigurations, autoscaling:DescribeLifecycleHookTypes, autoscaling:DescribeLifecycleHooks, autoscaling:DescribeLoadBalancerTargetGroups, autoscaling:DescribeLoadBalancers and 10 more
B2BI7 of 233 List, 4 Read; 7 restricted, 7 conditionalb2bi:GetCapability, b2bi:GetProfile, b2bi:GetTransformer, b2bi:ListCapabilities, b2bi:ListProfiles, b2bi:ListTagsForResource, b2bi:ListTransformers
Backup15 of 1226 List, 9 Read; 15 restricted, 15 conditionalbackup:DescribeBackupVault, backup:DescribeReportPlan, backup:GetBackupPlan, backup:GetBackupSelection, backup:GetBackupVaultAccessPolicy, backup:GetBackupVaultNotifications, backup:GetRestoreTestingPlan, backup:GetRestoreTestingSelection, backup:ListBackupPlans, backup:ListBackupSelections, backup:ListBackupVaults, backup:ListReportPlans and 3 more
Backup Gateway3 of 273 Read; 3 restricted, 3 conditionalbackup-gateway:GetHypervisor, backup-gateway:ListHypervisors, backup-gateway:ListTagsForResource
Batch6 of 461 List, 5 Read; 6 restricted, 6 conditionalbatch:DescribeComputeEnvironments, batch:DescribeConsumableResource, batch:DescribeJobQueues, batch:DescribeSchedulingPolicies, batch:ListConsumableResources, batch:ListSchedulingPolicies
BillingAndCostManagementDataExports3 of 121 List, 2 Read; 3 restricted, 3 conditionalbcm-data-exports:GetExport, bcm-data-exports:ListExports, bcm-data-exports:ListTagsForResource
Bedrock41 of 23221 List, 20 Read; 41 restricted, 41 conditionalbedrock:GetAgent, bedrock:GetAgentActionGroup, bedrock:GetAgentAlias, bedrock:GetAgentCollaborator, bedrock:GetAgentKnowledgeBase, bedrock:GetAgentVersion, bedrock:GetCustomModel, bedrock:GetDataSource, bedrock:GetFlow, bedrock:GetFlowAlias, bedrock:GetFlowExecution, bedrock:GetFlowVersion and 29 more
Bedrock-Agentcore31 of 19714 List, 17 Read; 31 restricted, 31 conditionalbedrock-agentcore:GetAgentRuntime, bedrock-agentcore:GetAgentRuntimeEndpoint, bedrock-agentcore:GetBrowser, bedrock-agentcore:GetCodeInterpreter, bedrock-agentcore:GetEvaluator, bedrock-agentcore:GetGateway, bedrock-agentcore:GetGatewayTarget, bedrock-agentcore:GetMemory, bedrock-agentcore:GetOnlineEvaluationConfig, bedrock-agentcore:GetPolicy, bedrock-agentcore:GetPolicyEngine, bedrock-agentcore:GetResourcePolicy and 19 more
Budget4 of 134 Read; 4 restricted, 4 conditionalbudgets:DescribeBudgetAction, budgets:DescribeBudgetActionsForAccount, budgets:DescribeBudgetActionsForBudget, budgets:ListTagsForResource
Cost Explorer Service3 of 591 List, 2 Read; 3 restricted, 3 conditionalce:DescribeCostCategoryDefinition, ce:ListCostCategoryDefinitions, ce:ListTagsForResource
Clean Rooms11 of 1076 List, 5 Read; 11 restricted, 11 conditionalcleanrooms:GetAnalysisTemplate, cleanrooms:GetCollaboration, cleanrooms:GetConfiguredTable, cleanrooms:GetConfiguredTableAnalysisRule, cleanrooms:GetMembership, cleanrooms:ListAnalysisTemplates, cleanrooms:ListCollaborations, cleanrooms:ListConfiguredTables, cleanrooms:ListMembers, cleanrooms:ListMemberships, cleanrooms:ListTagsForResource
Clean Rooms ML2 of 591 List, 1 Read; 2 restricted, 2 conditionalcleanrooms-ml:GetTrainingDataset, cleanrooms-ml:ListTrainingDatasets
Cloud93 of 293 Read; 3 restricted, 3 conditionalcloud9:DescribeEnvironments, cloud9:ListEnvironments, cloud9:ListTagsForResource
CloudFormation13 of 1046 List, 7 Read; 13 restricted, 13 conditionalcloudformation:DescribeStackInstance, cloudformation:DescribeStackSet, cloudformation:DescribeStacks, cloudformation:DescribeType, cloudformation:GetResource, cloudformation:GetStackPolicy, cloudformation:GetTemplate, cloudformation:ListResources, cloudformation:ListStackInstances, cloudformation:ListStackResources, cloudformation:ListStackSets, cloudformation:ListStacks and 1 more
CloudFront10 of 1734 List, 6 Read; 10 restricted, 10 conditionalcloudfront:DescribeKeyValueStore, cloudfront:GetDistribution, cloudfront:GetDistributionConfig, cloudfront:GetPublicKey, cloudfront:GetRealtimeLogConfig, cloudfront:ListDistributions, cloudfront:ListKeyValueStores, cloudfront:ListPublicKeys, cloudfront:ListRealtimeLogConfigs, cloudfront:ListTagsForResource
CloudTrail17 of 664 List, 12 Read, 1 Write; 17 restricted, 17 conditionalcloudtrail:DescribeTrails, cloudtrail:GetChannel, cloudtrail:GetEventConfiguration, cloudtrail:GetEventDataStore, cloudtrail:GetEventSelectors, cloudtrail:GetInsightSelectors, cloudtrail:GetQueryResults, cloudtrail:GetResourcePolicy, cloudtrail:GetTrail, cloudtrail:GetTrailStatus, cloudtrail:ListChannels, cloudtrail:ListDashboards and 5 more
CloudWatch6 of 1603 List, 3 Read; 6 restricted, 6 conditionalcloudwatch:DescribeAlarms, cloudwatch:GetMetricStream, cloudwatch:ListDashboards, cloudwatch:ListManagedInsightRules, cloudwatch:ListMetricStreams, cloudwatch:ListTagsForResource
CodeArtifact10 of 515 List, 5 Read; 10 restricted, 10 conditionalcodeartifact:DescribeDomain, codeartifact:DescribePackageGroup, codeartifact:DescribeRepository, codeartifact:GetDomainPermissionsPolicy, codeartifact:GetRepositoryPermissionsPolicy, codeartifact:ListAllowedRepositoriesForGroup, codeartifact:ListDomains, codeartifact:ListPackageGroups, codeartifact:ListRepositories, codeartifact:ListTagsForResource
CodeBuild2 of 671 List, 1 Read; 2 restricted, 2 conditionalcodebuild:BatchGetReportGroups, codebuild:ListReportGroups
CodeCommit2 of 912 Read; 2 restricted, 2 conditionalcodecommit:GetRepository, codecommit:GetRepositoryTriggers
CodeDeploy9 of 489 List; 9 restricted, 9 conditionalcodedeploy:GetApplication, codedeploy:GetDeployment, codedeploy:GetDeploymentConfig, codedeploy:GetDeploymentGroup, codedeploy:ListApplications, codedeploy:ListDeploymentConfigs, codedeploy:ListDeploymentGroups, codedeploy:ListDeployments, codedeploy:ListTagsForResource
CodeGuru Profiler5 of 212 List, 3 Read; 5 restricted, 5 conditionalcodeguru-profiler:DescribeProfilingGroup, codeguru-profiler:GetNotificationConfiguration, codeguru-profiler:GetPolicy, codeguru-profiler:ListProfilingGroups, codeguru-profiler:ListTagsForResource
CodeGuru Reviewer3 of 172 List, 1 Read; 3 restricted, 3 conditionalcodeguru-reviewer:DescribeRepositoryAssociation, codeguru-reviewer:ListRepositoryAssociations, codeguru-reviewer:ListTagsForResource
CodePipeline4 of 441 List, 3 Read; 4 restricted, 4 conditionalcodepipeline:GetPipeline, codepipeline:GetPipelineState, codepipeline:ListPipelines, codepipeline:ListTagsForResource
Cognito Identity5 of 211 List, 4 Read; 5 restricted, 5 conditionalcognito-identity:DescribeIdentityPool, cognito-identity:GetIdentityPoolRoles, cognito-identity:GetPrincipalTagAttributeMap, cognito-identity:ListIdentityPools, cognito-identity:ListTagsForResource
Cognito User Pools14 of 1395 List, 9 Read; 14 restricted, 14 conditionalcognito-idp:DescribeIdentityProvider, cognito-idp:DescribeResourceServer, cognito-idp:DescribeUserPool, cognito-idp:DescribeUserPoolClient, cognito-idp:DescribeUserPoolDomain, cognito-idp:GetGroup, cognito-idp:GetLogDeliveryConfiguration, cognito-idp:GetUICustomization, cognito-idp:GetUserPoolMfaConfig, cognito-idp:ListGroups, cognito-idp:ListIdentityProviders, cognito-idp:ListResourceServers and 2 more
Comprehend3 of 853 Read; 3 restricted, 3 conditionalcomprehend:DescribeFlywheel, comprehend:ListFlywheels, comprehend:ListTagsForResource
Config19 of 1029 List, 8 Read, 2 Write; 19 restricted, 16 conditionalconfig:BatchGetResourceConfig, config:DeleteServiceLinkedConfigurationRecorder, config:DescribeAggregationAuthorizations, config:DescribeComplianceByConfigRule, config:DescribeConfigRules, config:DescribeConfigurationAggregators, config:DescribeConfigurationRecorderStatus, config:DescribeConfigurationRecorders, config:DescribeConformancePacks, config:DescribeDeliveryChannels, config:DescribeOrganizationConformancePacks, config:GetComplianceDetailsByConfigRule and 7 more
Connect31 of 38820 List, 11 Read; 31 restricted, 31 conditionalconnect:DescribeInstance, connect:DescribePhoneNumber, connect:DescribePredefinedAttribute, connect:DescribePrompt, connect:DescribeQueue, connect:DescribeQuickConnect, connect:DescribeRoutingProfile, connect:DescribeRule, connect:DescribeSecurityProfile, connect:DescribeUser, connect:GetTaskTemplate, connect:ListInstanceAttributes and 19 more
Connect Outbound Campaigns2 of 401 List, 1 Read; 2 restricted, 2 conditionalconnect-campaigns:DescribeCampaign, connect-campaigns:ListCampaigns
DataBrew9 of 449 Read; 9 restricted, 9 conditionaldatabrew:DescribeDataset, databrew:DescribeJob, databrew:DescribeRuleset, databrew:DescribeSchedule, databrew:ListDatasets, databrew:ListJobs, databrew:ListRulesets, databrew:ListSchedules, databrew:ListTagsForResource
DataSync16 of 663 List, 13 Read; 16 restricted, 16 conditionaldatasync:DescribeAgent, datasync:DescribeLocationAzureBlob, datasync:DescribeLocationEfs, datasync:DescribeLocationFsxLustre, datasync:DescribeLocationFsxOntap, datasync:DescribeLocationFsxOpenZfs, datasync:DescribeLocationFsxWindows, datasync:DescribeLocationHdfs, datasync:DescribeLocationObjectStorage, datasync:DescribeLocationS3, datasync:DescribeLocationSmb, datasync:DescribeTask and 4 more
DynamoDBAccelerator2 of 301 List, 1 Read; 2 restricted, 2 conditionaldax:DescribeParameterGroups, dax:DescribeParameters
Deadline Cloud9 of 924 List, 5 Read; 9 restricted, 9 conditionaldeadline:GetFleet, deadline:GetLicenseEndpoint, deadline:GetQueueEnvironment, deadline:GetStorageProfile, deadline:ListFleets, deadline:ListLicenseEndpoints, deadline:ListQueueEnvironments, deadline:ListStorageProfiles, deadline:ListTagsForResource
Detective4 of 363 List, 1 Read; 4 restricted, 4 conditionaldetective:DescribeOrganizationConfiguration, detective:ListGraphs, detective:ListOrganizationAdminAccount, detective:ListTagsForResource
Device Farm5 of 773 List, 2 Read; 5 restricted, 5 conditionaldevicefarm:GetInstanceProfile, devicefarm:GetTestGridProject, devicefarm:ListInstanceProfiles, devicefarm:ListTagsForResource, devicefarm:ListTestGridProjects
DMS8 of 1258 Read; 8 restricted, 8 conditionaldms:DescribeCertificates, dms:DescribeDataMigrations, dms:DescribeEndpoints, dms:DescribeEventSubscriptions, dms:DescribeReplicationSubnetGroups, dms:DescribeReplicationTasks, dms:ListMigrationProjects, dms:ListTagsForResource
Directory Service1 of 911 List; 1 restricted, 1 conditionalds:DescribeDirectories
Aurora DSQL5 of 301 List, 4 Read; 5 restricted, 5 conditionaldsql:GetCluster, dsql:GetClusterPolicy, dsql:GetVpcEndpointServiceName, dsql:ListClusters, dsql:ListTagsForResource
DynamoDB10 of 682 List, 8 Read; 10 restricted, 10 conditionaldynamodb:DescribeBackup, dynamodb:DescribeContinuousBackups, dynamodb:DescribeContributorInsights, dynamodb:DescribeKinesisStreamingDestination, dynamodb:DescribeTable, dynamodb:DescribeTimeToLive, dynamodb:GetResourcePolicy, dynamodb:ListBackups, dynamodb:ListTables, dynamodb:ListTagsOfResource
EC2200 of 834195 List, 5 Read; 200 restricted, 200 conditionalec2:DescribeAccountAttributes, ec2:DescribeAccountVpcEncryptionControl, ec2:DescribeAddressTransfers, ec2:DescribeAddresses, ec2:DescribeAddressesAttribute, ec2:DescribeAggregateIdFormat, ec2:DescribeApplicationStatus, ec2:DescribeApplicationStatusCheckAssociations, ec2:DescribeApplicationStatusChecks, ec2:DescribeAvailabilityZones, ec2:DescribeAwsNetworkPerformanceMetricSubscriptions, ec2:DescribeBundleTasks and 188 more
Elastic Container Registry12 of 653 List, 9 Read; 12 restricted, 12 conditionalecr:DescribeImageScanFindings, ecr:DescribeImages, ecr:DescribePullThroughCacheRules, ecr:DescribeRegistry, ecr:DescribeRepositories, ecr:DescribeRepositoryCreationTemplates, ecr:GetLifecyclePolicy, ecr:GetRegistryPolicy, ecr:GetRegistryScanningConfiguration, ecr:GetRepositoryPolicy, ecr:ListImages, ecr:ListTagsForResource
Elastic Container Service16 of 927 List, 9 Read; 16 restricted, 16 conditionalecs:DescribeCapacityProviders, ecs:DescribeClusters, ecs:DescribeContainerInstances, ecs:DescribeDaemon, ecs:DescribeServices, ecs:DescribeTaskDefinition, ecs:DescribeTaskSets, ecs:DescribeTasks, ecs:ListClusters, ecs:ListContainerInstances, ecs:ListDaemons, ecs:ListServices and 4 more
EKS20 of 749 List, 11 Read; 20 restricted, 20 conditionaleks:DescribeAccessEntry, eks:DescribeAddon, eks:DescribeAddonVersions, eks:DescribeCapability, eks:DescribeCluster, eks:DescribeFargateProfile, eks:DescribeIdentityProviderConfig, eks:DescribeNodegroup, eks:DescribePodIdentityAssociation, eks:DescribeUpdate, eks:ListAccessEntries, eks:ListAddons and 8 more
ElastiCache6 of 775 List, 1 Read; 6 restricted, 6 conditionalelasticache:DescribeCacheParameterGroups, elasticache:DescribeCacheParameters, elasticache:DescribeCacheSubnetGroups, elasticache:DescribeUserGroups, elasticache:DescribeUsers, elasticache:ListTagsForResource
Elastic Beanstalk3 of 501 List, 2 Read; 3 restricted, 3 conditionalelasticbeanstalk:DescribeConfigurationSettings, elasticbeanstalk:DescribeEnvironments, elasticbeanstalk:ListTagsForResource
EFS9 of 383 List, 6 Read; 9 restricted, 9 conditionalelasticfilesystem:DescribeAccessPoints, elasticfilesystem:DescribeBackupPolicy, elasticfilesystem:DescribeFileSystemPolicy, elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeLifecycleConfiguration, elasticfilesystem:DescribeMountTargetSecurityGroups, elasticfilesystem:DescribeMountTargets, elasticfilesystem:DescribeReplicationConfigurations, elasticfilesystem:ListTagsForResource
ELB10 of 771 List, 9 Read; 10 restricted, 10 conditionalelasticloadbalancing:DescribeCapacityReservation, elasticloadbalancing:DescribeListenerAttributes, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeTags, elasticloadbalancing:DescribeTargetGroupAttributes, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth
EMR4 of 882 List, 2 Read; 4 restricted, 4 conditionalelasticmapreduce:DescribeSecurityConfiguration, elasticmapreduce:DescribeStudio, elasticmapreduce:ListSecurityConfigurations, elasticmapreduce:ListStudios
EMR Containers2 of 251 List, 1 Read; 2 restricted, 2 conditionalemr-containers:DescribeVirtualCluster, emr-containers:ListVirtualClusters
EMR Serverless2 of 251 List, 1 Read; 2 restricted, 2 conditionalemr-serverless:GetApplication, emr-serverless:ListApplications
Entity Resolution7 of 403 List, 4 Read; 7 restricted, 7 conditionalentityresolution:GetIdMappingWorkflow, entityresolution:GetMatchingWorkflow, entityresolution:GetSchemaMapping, entityresolution:ListIdMappingWorkflows, entityresolution:ListMatchingWorkflows, entityresolution:ListSchemaMappings, entityresolution:ListTagsForResource
OpenSearch Service2 of 1382 Read; 2 restricted, 2 conditionales:DescribeDomain, es:ListTags
EventBridge14 of 718 List, 6 Read; 14 restricted, 14 conditionalevents:DescribeApiDestination, events:DescribeArchive, events:DescribeConnection, events:DescribeEndpoint, events:DescribeEventBus, events:DescribeRule, events:ListApiDestinations, events:ListArchives, events:ListConnections, events:ListEndpoints, events:ListEventBuses, events:ListRules and 2 more
Firehose3 of 102 List, 1 Read; 3 restricted, 3 conditionalfirehose:DescribeDeliveryStream, firehose:ListDeliveryStreams, firehose:ListTagsForDeliveryStream
FIS3 of 291 List, 2 Read; 3 restricted, 3 conditionalfis:GetExperimentTemplate, fis:ListExperimentTemplates, fis:ListTagsForResource
Forecast4 of 704 Read; 4 restricted, 4 conditionalforecast:DescribeDataset, forecast:DescribeDatasetGroup, forecast:ListDatasetGroups, forecast:ListDatasets
Fraud Detector2 of 741 List, 1 Read; 2 restricted, 2 conditionalfrauddetector:GetVariables, frauddetector:ListTagsForResource
GameLift Servers18 of 1216 List, 12 Read; 18 restricted, 18 conditionalgamelift:DescribeAlias, gamelift:DescribeBuild, gamelift:DescribeContainerFleet, gamelift:DescribeContainerGroupDefinition, gamelift:DescribeFleetLocationAttributes, gamelift:DescribeFleetLocationCapacity, gamelift:DescribeGameServerGroup, gamelift:DescribeGameSessionQueues, gamelift:DescribeMatchmakingConfigurations, gamelift:DescribeMatchmakingRuleSets, gamelift:DescribeScalingPolicies, gamelift:ListAliases and 6 more
Location12 of 646 List, 6 Read; 12 restricted, 12 conditionalgeo:DescribeGeofenceCollection, geo:DescribeKey, geo:DescribeMap, geo:DescribePlaceIndex, geo:DescribeRouteCalculator, geo:DescribeTracker, geo:ListGeofenceCollections, geo:ListKeys, geo:ListMaps, geo:ListPlaceIndexes, geo:ListRouteCalculators, geo:ListTrackers
GlobalAccelerator8 of 563 List, 5 Read; 8 restricted, 8 conditionalglobalaccelerator:DescribeAccelerator, globalaccelerator:DescribeAcceleratorAttributes, globalaccelerator:DescribeEndpointGroup, globalaccelerator:DescribeListener, globalaccelerator:ListAccelerators, globalaccelerator:ListEndpointGroups, globalaccelerator:ListListeners, globalaccelerator:ListTagsForResource
Glue16 of 3066 List, 10 Read; 16 restricted, 16 conditionalglue:GetClassifier, glue:GetClassifiers, glue:GetCrawler, glue:GetDatabase, glue:GetDatabases, glue:GetJob, glue:GetMLTransform, glue:GetMLTransforms, glue:GetRegistry, glue:GetTags, glue:GetWorkflow, glue:ListCrawlers and 4 more
Managed Grafana5 of 255 Read; 5 restricted, 5 conditionalgrafana:DescribeWorkspace, grafana:DescribeWorkspaceAuthentication, grafana:DescribeWorkspaceConfiguration, grafana:ListTagsForResource, grafana:ListWorkspaces
IoT Greengrass3 of 1121 List, 2 Read; 3 restricted, 3 conditionalgreengrass:DescribeComponent, greengrass:ListComponentVersions, greengrass:ListTagsForResource
Ground Station7 of 403 List, 4 Read; 7 restricted, 7 conditionalgroundstation:GetConfig, groundstation:GetDataflowEndpointGroup, groundstation:GetMissionProfile, groundstation:ListConfigs, groundstation:ListDataflowEndpointGroups, groundstation:ListMissionProfiles, groundstation:ListTagsForResource
GuardDuty22 of 10310 List, 12 Read; 22 restricted, 22 conditionalguardduty:DescribeOrganizationConfiguration, guardduty:GetAdministratorAccount, guardduty:GetDetector, guardduty:GetFilter, guardduty:GetFindings, guardduty:GetIPSet, guardduty:GetMalwareProtectionPlan, guardduty:GetMasterAccount, guardduty:GetMemberDetectors, guardduty:GetMembers, guardduty:GetThreatIntelSet, guardduty:ListDetectors and 10 more
IAM41 of 19024 List, 16 Read, 1 Write; 41 restricted, 38 conditionaliam:CreateServiceLinkedRole, iam:GenerateCredentialReport, iam:GetAccessKeyLastUsed, iam:GetAccountPasswordPolicy, iam:GetAccountSummary, iam:GetCredentialReport, iam:GetGroup, iam:GetGroupPolicy, iam:GetInstanceProfile, iam:GetLoginProfile, iam:GetOpenIDConnectProvider, iam:GetPolicy and 29 more
Identity Store4 of 292 List, 2 Read; 4 restricted, 4 conditionalidentitystore:DescribeGroup, identitystore:DescribeUser, identitystore:ListGroupMembershipsForMember, identitystore:ListUsers
EC2 Image Builder12 of 776 List, 6 Read; 12 restricted, 12 conditionalimagebuilder:GetContainerRecipe, imagebuilder:GetDistributionConfiguration, imagebuilder:GetImagePipeline, imagebuilder:GetImageRecipe, imagebuilder:GetInfrastructureConfiguration, imagebuilder:GetLifecyclePolicy, imagebuilder:ListContainerRecipes, imagebuilder:ListDistributionConfigurations, imagebuilder:ListImagePipelines, imagebuilder:ListImageRecipes, imagebuilder:ListInfrastructureConfigurations, imagebuilder:ListLifecyclePolicies
Inspector22 of 841 List, 1 Read; 2 restricted, 2 conditionalinspector2:ListFilters, inspector2:ListTagsForResource
Internet Monitor3 of 171 List, 2 Read; 3 restricted, 3 conditionalinternetmonitor:GetMonitor, internetmonitor:ListMonitors, internetmonitor:ListTagsForResource
IoT34 of 29317 List, 17 Read; 34 restricted, 34 conditionaliot:DescribeAccountAuditConfiguration, iot:DescribeAuthorizer, iot:DescribeBillingGroup, iot:DescribeCACertificate, iot:DescribeCustomMetric, iot:DescribeDomainConfiguration, iot:DescribeFleetMetric, iot:DescribeJobTemplate, iot:DescribeMitigationAction, iot:DescribeProvisioningTemplate, iot:DescribeRoleAlias, iot:DescribeScheduledAudit and 22 more
IoT Device Advisor2 of 141 List, 1 Read; 2 restricted, 2 conditionaliotdeviceadvisor:GetSuiteDefinition, iotdeviceadvisor:ListSuiteDefinitions
IoT FleetWise7 of 561 List, 6 Read; 7 restricted, 7 conditionaliotfleetwise:GetModelManifest, iotfleetwise:GetSignalCatalog, iotfleetwise:ListModelManifestNodes, iotfleetwise:ListModelManifests, iotfleetwise:ListSignalCatalogNodes, iotfleetwise:ListSignalCatalogs, iotfleetwise:ListTagsForResource
IoT SiteWise21 of 12911 List, 10 Read; 21 restricted, 21 conditionaliotsitewise:DescribeAsset, iotsitewise:DescribeAssetModel, iotsitewise:DescribeAssetModelCompositeModel, iotsitewise:DescribeAssetModelInterfaceRelationship, iotsitewise:DescribeDashboard, iotsitewise:DescribeGateway, iotsitewise:DescribeGatewayCapabilityConfiguration, iotsitewise:DescribePortal, iotsitewise:DescribeProject, iotsitewise:ListAssetModelCompositeModels, iotsitewise:ListAssetModelProperties, iotsitewise:ListAssetModels and 9 more
IoT TwinMaker11 of 377 List, 4 Read; 11 restricted, 11 conditionaliottwinmaker:GetComponentType, iottwinmaker:GetEntity, iottwinmaker:GetScene, iottwinmaker:GetWorkspace, iottwinmaker:ListComponentTypes, iottwinmaker:ListComponents, iottwinmaker:ListEntities, iottwinmaker:ListProperties, iottwinmaker:ListScenes, iottwinmaker:ListTagsForResource, iottwinmaker:ListWorkspaces
IoT Wireless17 of 11317 Read; 17 restricted, 17 conditionaliotwireless:GetDestination, iotwireless:GetDeviceProfile, iotwireless:GetFuotaTask, iotwireless:GetNetworkAnalyzerConfiguration, iotwireless:GetServiceProfile, iotwireless:GetWirelessDevice, iotwireless:GetWirelessGateway, iotwireless:GetWirelessGatewayTaskDefinition, iotwireless:ListDestinations, iotwireless:ListDeviceProfiles, iotwireless:ListFuotaTasks, iotwireless:ListNetworkAnalyzerConfigurations and 5 more
Interactive Video Service11 of 835 List, 6 Read; 11 restricted, 11 conditionalivs:GetChannel, ivs:GetEncoderConfiguration, ivs:GetPlaybackRestrictionPolicy, ivs:GetRecordingConfiguration, ivs:GetStorageConfiguration, ivs:ListChannels, ivs:ListEncoderConfigurations, ivs:ListPlaybackRestrictionPolicies, ivs:ListRecordingConfigurations, ivs:ListStorageConfigurations, ivs:ListTagsForResource
MSK8 of 644 List, 4 Read; 8 restricted, 8 conditionalkafka:DescribeCluster, kafka:DescribeClusterV2, kafka:DescribeVpcConnection, kafka:GetClusterPolicy, kafka:ListClusters, kafka:ListClustersV2, kafka:ListScramSecrets, kafka:ListVpcConnections
MSK Connect5 of 215 Read; 5 restricted, 5 conditionalkafkaconnect:DescribeConnector, kafkaconnect:DescribeCustomPlugin, kafkaconnect:ListConnectors, kafkaconnect:ListCustomPlugins, kafkaconnect:ListTagsForResource
Kendra3 of 661 List, 2 Read; 3 restricted, 3 conditionalkendra:DescribeIndex, kendra:ListIndices, kendra:ListTagsForResource
Kinesis5 of 421 List, 4 Read; 5 restricted, 5 conditionalkinesis:DescribeStreamSummary, kinesis:GetResourcePolicy, kinesis:ListStreams, kinesis:ListTagsForResource, kinesis:ListTagsForStream
Kinesis Analytics3 of 341 List, 2 Read; 3 restricted, 3 conditionalkinesisanalytics:DescribeApplication, kinesisanalytics:ListApplications, kinesisanalytics:ListTagsForResource
Kinesis Video Streams7 of 374 List, 3 Read; 7 restricted, 7 conditionalkinesisvideo:DescribeSignalingChannel, kinesisvideo:DescribeStream, kinesisvideo:DescribeStreamStorageConfiguration, kinesisvideo:ListSignalingChannels, kinesisvideo:ListStreams, kinesisvideo:ListTagsForResource, kinesisvideo:ListTagsForStream
KMS7 of 584 List, 3 Read; 7 restricted, 7 conditionalkms:DescribeKey, kms:GetKeyPolicy, kms:GetKeyRotationStatus, kms:ListAliases, kms:ListGrants, kms:ListKeys, kms:ListResourceTags
Lake Formation3 of 681 List, 2 Read; 3 restricted, 3 conditionallakeformation:DescribeLakeFormationIdentityCenterConfiguration, lakeformation:DescribeResource, lakeformation:ListResources
Lambda25 of 12111 List, 14 Read; 25 restricted, 25 conditionallambda:GetAlias, lambda:GetCodeSigningConfig, lambda:GetEventSourceMapping, lambda:GetFunction, lambda:GetFunctionCodeSigningConfig, lambda:GetFunctionConfiguration, lambda:GetFunctionRecursionConfig, lambda:GetFunctionScalingConfig, lambda:GetFunctionUrlConfig, lambda:GetLayerVersionPolicy, lambda:GetPolicy, lambda:GetProvisionedConcurrencyConfig and 13 more
Lex12 of 1467 List, 5 Read; 12 restricted, 12 conditionallex:DescribeBot, lex:DescribeBotAlias, lex:DescribeBotReplica, lex:GetBotAlias, lex:ListBotAliases, lex:ListBotLocales, lex:ListBotReplicas, lex:ListBots, lex:ListIntents, lex:ListSlotTypes, lex:ListSlots, lex:ListTagsForResource
License Manager5 of 621 List, 4 Read; 5 restricted, 5 conditionallicense-manager:GetGrant, license-manager:GetLicense, license-manager:ListDistributedGrants, license-manager:ListLicenses, license-manager:ListTagsForResource
Lightsail6 of 1616 Read; 6 restricted, 6 conditionallightsail:GetBuckets, lightsail:GetCertificates, lightsail:GetDisk, lightsail:GetDisks, lightsail:GetStaticIp, lightsail:GetStaticIps
CloudWatch Logs17 of 13312 List, 5 Read; 17 restricted, 17 conditionallogs:DescribeDeliveryDestinations, logs:DescribeDeliverySources, logs:DescribeDestinations, logs:DescribeIndexPolicies, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:DescribeMetricFilters, logs:DescribeQueryDefinitions, logs:DescribeResourcePolicies, logs:DescribeSubscriptionFilters, logs:FilterLogEvents, logs:GetDataProtectionPolicy and 5 more
Mainframe Modernization3 of 371 List, 2 Read; 3 restricted, 3 conditionalm2:GetEnvironment, m2:ListEnvironments, m2:ListTagsForResource
Macie4 of 812 List, 2 Read; 4 restricted, 4 conditionalmacie2:GetCustomDataIdentifier, macie2:GetMacieSession, macie2:ListAutomatedDiscoveryAccounts, macie2:ListCustomDataIdentifiers
MediaConnect5 of 952 List, 3 Read; 5 restricted, 5 conditionalmediaconnect:DescribeFlow, mediaconnect:DescribeGateway, mediaconnect:ListFlows, mediaconnect:ListGateways, mediaconnect:ListTagsForResource
MediaLive6 of 1253 List, 3 Read; 6 restricted, 6 conditionalmedialive:DescribeMultiplexProgram, medialive:GetCloudWatchAlarmTemplate, medialive:GetEventBridgeRuleTemplate, medialive:ListCloudWatchAlarmTemplates, medialive:ListEventBridgeRuleTemplates, medialive:ListMultiplexPrograms
MediaPackage VOD6 of 173 List, 3 Read; 6 restricted, 6 conditionalmediapackage-vod:DescribeAsset, mediapackage-vod:DescribePackagingConfiguration, mediapackage-vod:DescribePackagingGroup, mediapackage-vod:ListAssets, mediapackage-vod:ListPackagingConfigurations, mediapackage-vod:ListPackagingGroups
MediaPackage v24 of 342 List, 2 Read; 4 restricted, 4 conditionalmediapackagev2:GetChannel, mediapackagev2:GetOriginEndpoint, mediapackagev2:ListChannels, mediapackagev2:ListOriginEndpoints
MediaTailor8 of 441 List, 7 Read; 8 restricted, 8 conditionalmediatailor:DescribeChannel, mediatailor:DescribeLiveSource, mediatailor:DescribeSourceLocation, mediatailor:GetPlaybackConfiguration, mediatailor:ListChannels, mediatailor:ListLiveSources, mediatailor:ListPlaybackConfigurations, mediatailor:ListSourceLocations
MemoryDB2 of 472 Read; 2 restricted, 2 conditionalmemorydb:DescribeSubnetGroups, memorydb:ListTags
MQ3 of 271 List, 2 Read; 3 restricted, 3 conditionalmq:DescribeBroker, mq:DescribeSharedResources, mq:ListBrokers
Network Firewall9 of 895 List, 4 Read; 9 restricted, 9 conditionalnetwork-firewall:DescribeFirewall, network-firewall:DescribeFirewallPolicy, network-firewall:DescribeRuleGroup, network-firewall:DescribeTLSInspectionConfiguration, network-firewall:ListFirewallPolicies, network-firewall:ListFirewalls, network-firewall:ListRuleGroups, network-firewall:ListTLSInspectionConfigurations, network-firewall:ListTagsForResource
Network Manager7 of 977 List; 7 restricted, 7 conditionalnetworkmanager:DescribeGlobalNetworks, networkmanager:GetCustomerGatewayAssociations, networkmanager:GetDevices, networkmanager:GetLinkAssociations, networkmanager:GetLinks, networkmanager:GetSites, networkmanager:GetTransitGatewayRegistrations
Omics10 of 1085 List, 5 Read; 10 restricted, 10 conditionalomics:GetReferenceStore, omics:GetRunGroup, omics:GetS3AccessPolicy, omics:GetSequenceStore, omics:GetWorkflow, omics:ListReferenceStores, omics:ListRunGroups, omics:ListSequenceStores, omics:ListTagsForResource, omics:ListWorkflows
Organizations11 of 637 List, 4 Read; 0 restricted, 0 conditionalorganizations:DescribeAccount, organizations:DescribeOrganization, organizations:DescribeOrganizationalUnit, organizations:DescribePolicy, organizations:ListAccounts, organizations:ListDelegatedAdministrators, organizations:ListOrganizationalUnitsForParent, organizations:ListParents, organizations:ListPolicies, organizations:ListTagsForResource, organizations:ListTargetsForPolicy
Payment Cryptography6 of 472 List, 4 Read; 6 restricted, 6 conditionalpayment-cryptography:GetAlias, payment-cryptography:GetKey, payment-cryptography:GetResourcePolicy, payment-cryptography:ListAliases, payment-cryptography:ListKeys, payment-cryptography:ListTagsForResource
Private CA Connector for Active Directory7 of 253 List, 4 Read; 7 restricted, 7 conditionalpca-connector-ad:GetConnector, pca-connector-ad:GetDirectoryRegistration, pca-connector-ad:GetTemplate, pca-connector-ad:ListConnectors, pca-connector-ad:ListDirectoryRegistrations, pca-connector-ad:ListTagsForResource, pca-connector-ad:ListTemplates
Private CA Connector for SCEP5 of 122 List, 3 Read; 5 restricted, 5 conditionalpca-connector-scep:GetChallengeMetadata, pca-connector-scep:GetConnector, pca-connector-scep:ListChallengeMetadata, pca-connector-scep:ListConnectors, pca-connector-scep:ListTagsForResource
Personalize11 of 836 List, 5 Read; 11 restricted, 11 conditionalpersonalize:DescribeDataset, personalize:DescribeDatasetGroup, personalize:DescribeDatasetImportJob, personalize:DescribeSchema, personalize:DescribeSolution, personalize:ListDatasetGroups, personalize:ListDatasetImportJobs, personalize:ListDatasets, personalize:ListSchemas, personalize:ListSolutions, personalize:ListTagsForResource
Profile5 of 1172 List, 3 Read; 5 restricted, 5 conditionalprofile:GetDomain, profile:GetProfileObjectType, profile:ListDomains, profile:ListProfileObjectTypes, profile:ListTagsForResource
Q Business3 of 671 List, 2 Read; 3 restricted, 3 conditionalqbusiness:GetApplication, qbusiness:ListApplications, qbusiness:ListTagsForResource
QuickSight17 of 3575 List, 12 Read; 17 restricted, 17 conditionalquicksight:DescribeDashboard, quicksight:DescribeDashboardPermissions, quicksight:DescribeDataSet, quicksight:DescribeDataSetPermissions, quicksight:DescribeDataSetRefreshProperties, quicksight:DescribeDataSource, quicksight:DescribeDataSourcePermissions, quicksight:DescribeTemplate, quicksight:DescribeTemplatePermissions, quicksight:DescribeTheme, quicksight:DescribeThemePermissions, quicksight:ListDashboards and 5 more
Resource Access Manager1 of 391 Read; 1 restricted, 1 conditionalram:GetResourceShares
RDS19 of 17318 List, 1 Read; 19 restricted, 19 conditionalrds:DescribeDBClusterParameterGroups, rds:DescribeDBClusterParameters, rds:DescribeDBClusterSnapshots, rds:DescribeDBClusters, rds:DescribeDBEngineVersions, rds:DescribeDBInstanceAutomatedBackups, rds:DescribeDBInstances, rds:DescribeDBParameterGroups, rds:DescribeDBParameters, rds:DescribeDBProxies, rds:DescribeDBProxyEndpoints, rds:DescribeDBShardGroups and 7 more
Redshift13 of 1674 List, 9 Read; 13 restricted, 13 conditionalredshift:DescribeClusterDbRevisions, redshift:DescribeClusterParameterGroups, redshift:DescribeClusterParameters, redshift:DescribeClusterSubnetGroups, redshift:DescribeClusters, redshift:DescribeEndpointAccess, redshift:DescribeEndpointAuthorization, redshift:DescribeEventSubscriptions, redshift:DescribeIntegrations, redshift:DescribeLoggingStatus, redshift:DescribeScheduledActions, redshift:DescribeTags and 1 more
Rekognition2 of 762 Read; 2 restricted, 2 conditionalrekognition:DescribeProjects, rekognition:ListTagsForResource
Resilience Hub8 of 1334 List, 4 Read; 8 restricted, 8 conditionalresiliencehub:DescribeApp, resiliencehub:DescribeAppVersionTemplate, resiliencehub:DescribeResiliencyPolicy, resiliencehub:ListAppVersionResourceMappings, resiliencehub:ListAppVersions, resiliencehub:ListApps, resiliencehub:ListResiliencyPolicies, resiliencehub:ListTagsForResource
Resource Explorer6 of 372 List, 4 Read; 6 restricted, 6 conditionalresource-explorer-2:GetDefaultView, resource-explorer-2:GetIndex, resource-explorer-2:GetView, resource-explorer-2:ListIndexes, resource-explorer-2:ListViews, resource-explorer-2:Search
Resource Groups6 of 292 List, 4 Read; 6 restricted, 6 conditionalresource-groups:GetGroup, resource-groups:GetGroupConfiguration, resource-groups:GetGroupQuery, resource-groups:GetTags, resource-groups:ListGroupResources, resource-groups:ListGroups
IAM Roles Anywhere7 of 304 List, 3 Read; 7 restricted, 7 conditionalrolesanywhere:GetCrl, rolesanywhere:GetProfile, rolesanywhere:GetTrustAnchor, rolesanywhere:ListCrls, rolesanywhere:ListProfiles, rolesanywhere:ListTagsForResource, rolesanywhere:ListTrustAnchors
Route 537 of 713 List, 4 Read; 7 restricted, 7 conditionalroute53:GetDNSSEC, route53:GetHealthCheck, route53:GetHostedZone, route53:ListHealthChecks, route53:ListHostedZones, route53:ListQueryLoggingConfigs, route53:ListTagsForResource
Route 53 Recovery Controls9 of 279 Read; 9 restricted, 9 conditionalroute53-recovery-control-config:DescribeCluster, route53-recovery-control-config:DescribeControlPanel, route53-recovery-control-config:DescribeRoutingControl, route53-recovery-control-config:DescribeSafetyRule, route53-recovery-control-config:ListClusters, route53-recovery-control-config:ListControlPanels, route53-recovery-control-config:ListRoutingControls, route53-recovery-control-config:ListSafetyRules, route53-recovery-control-config:ListTagsForResource
Route 53 Recovery Readiness9 of 329 Read; 9 restricted, 9 conditionalroute53-recovery-readiness:GetCell, route53-recovery-readiness:GetReadinessCheck, route53-recovery-readiness:GetRecoveryGroup, route53-recovery-readiness:GetResourceSet, route53-recovery-readiness:ListCells, route53-recovery-readiness:ListReadinessChecks, route53-recovery-readiness:ListRecoveryGroups, route53-recovery-readiness:ListResourceSets, route53-recovery-readiness:ListTagsForResources
Route 53 Profiles5 of 193 List, 2 Read; 5 restricted, 5 conditionalroute53profiles:GetProfile, route53profiles:GetProfileAssociation, route53profiles:ListProfileAssociations, route53profiles:ListProfiles, route53profiles:ListTagsForResource
Route 53 Resolver15 of 708 List, 7 Read; 15 restricted, 15 conditionalroute53resolver:GetFirewallDomainList, route53resolver:GetFirewallRuleGroup, route53resolver:GetFirewallRuleGroupAssociation, route53resolver:GetResolverEndpoint, route53resolver:GetResolverQueryLogConfig, route53resolver:GetResolverQueryLogConfigAssociation, route53resolver:ListFirewallDomainLists, route53resolver:ListFirewallRuleGroupAssociations, route53resolver:ListFirewallRuleGroups, route53resolver:ListFirewallRules, route53resolver:ListResolverEndpointIpAddresses, route53resolver:ListResolverEndpoints and 3 more
CloudWatch RUM6 of 191 List, 5 Read; 6 restricted, 6 conditionalrum:BatchGetRumMetricDefinitions, rum:GetAppMonitor, rum:GetResourcePolicy, rum:ListAppMonitors, rum:ListRumMetricsDestinations, rum:ListTagsForResource
S340 of 1558 List, 32 Read; 40 restricted, 40 conditionals3:GetAccelerateConfiguration, s3:GetAccessGrant, s3:GetAccessGrantsLocation, s3:GetAccessPoint, s3:GetAccessPointPolicy, s3:GetAccountPublicAccessBlock, s3:GetAnalyticsConfiguration, s3:GetBucketAbac, s3:GetBucketAcl, s3:GetBucketCORS, s3:GetBucketLocation, s3:GetBucketLogging and 28 more
S3 Express7 of 282 List, 5 Read; 7 restricted, 7 conditionals3express:GetBucketPolicy, s3express:GetEncryptionConfiguration, s3express:GetInventoryConfiguration, s3express:GetLifecycleConfiguration, s3express:GetMetricsConfiguration, s3express:ListAllMyDirectoryBuckets, s3express:ListTagsForResource
S3 Tables9 of 612 List, 7 Read; 9 restricted, 9 conditionals3tables:GetTableBucket, s3tables:GetTableBucketEncryption, s3tables:GetTableBucketMaintenanceConfiguration, s3tables:GetTableBucketMetricsConfiguration, s3tables:GetTableBucketPolicy, s3tables:GetTableBucketReplication, s3tables:GetTableBucketStorageClass, s3tables:ListTableBuckets, s3tables:ListTagsForResource
S3 Vectors4 of 212 List, 2 Read; 4 restricted, 4 conditionals3vectors:GetVectorBucket, s3vectors:GetVectorBucketPolicy, s3vectors:ListTagsForResource, s3vectors:ListVectorBuckets
SageMaker39 of 44118 List, 21 Read; 39 restricted, 39 conditionalsagemaker:DescribeApp, sagemaker:DescribeAppImageConfig, sagemaker:DescribeCluster, sagemaker:DescribeCodeRepository, sagemaker:DescribeDomain, sagemaker:DescribeEndpoint, sagemaker:DescribeEndpointConfig, sagemaker:DescribeFeatureGroup, sagemaker:DescribeImage, sagemaker:DescribeImageVersion, sagemaker:DescribeInferenceExperiment, sagemaker:DescribeMlflowTrackingServer and 27 more
EventBridge Scheduler3 of 131 List, 2 Read; 3 restricted, 3 conditionalscheduler:GetScheduleGroup, scheduler:ListScheduleGroups, scheduler:ListTagsForResource
EventBridge Schemas8 of 314 List, 4 Read; 8 restricted, 8 conditionalschemas:DescribeDiscoverer, schemas:DescribeRegistry, schemas:DescribeSchema, schemas:GetResourcePolicy, schemas:ListDiscoverers, schemas:ListRegistries, schemas:ListSchemaVersions, schemas:ListSchemas
Secrets Manager3 of 271 List, 2 Read; 3 restricted, 3 conditionalsecretsmanager:DescribeSecret, secretsmanager:GetResourcePolicy, secretsmanager:ListSecrets
SecurityHub6 of 1412 List, 4 Read; 6 restricted, 6 conditionalsecurityhub:BatchGetSecurityControls, securityhub:DescribeHub, securityhub:GetEnabledStandards, securityhub:GetFindings, securityhub:ListSecurityControlDefinitions, securityhub:ListTagsForResource
Service Catalog7 of 1173 List, 4 Read; 7 restricted, 7 conditionalservicecatalog:DescribePortfolio, servicecatalog:DescribeProductAsAdmin, servicecatalog:DescribeProvisioningArtifact, servicecatalog:ListPortfolios, servicecatalog:ListProvisioningArtifacts, servicecatalog:ListTagsForResource, servicecatalog:SearchProductsAsAdmin
Cloud Map8 of 318 Read; 8 restricted, 8 conditionalservicediscovery:GetInstance, servicediscovery:GetNamespace, servicediscovery:GetService, servicediscovery:GetServiceAttributes, servicediscovery:ListInstances, servicediscovery:ListNamespaces, servicediscovery:ListServices, servicediscovery:ListTagsForResource
SES16 of 2316 List, 10 Read; 16 restricted, 16 conditionalses:DescribeConfigurationSet, ses:GetConfigurationSet, ses:GetContactList, ses:GetDedicatedIpPool, ses:GetDedicatedIps, ses:GetEmailTemplate, ses:GetTemplate, ses:GetTrafficPolicy, ses:ListConfigurationSets, ses:ListContactLists, ses:ListDedicatedIpPools, ses:ListEmailTemplates and 4 more
Shield5 of 402 List, 3 Read; 5 restricted, 5 conditionalshield:DescribeProtection, shield:DescribeProtectionGroup, shield:ListProtectionGroups, shield:ListProtections, shield:ListTagsForResource
Signer2 of 181 List, 1 Read; 2 restricted, 2 conditionalsigner:GetSigningProfile, signer:ListSigningProfiles
SNS5 of 402 List, 3 Read; 5 restricted, 5 conditionalsns:GetDataProtectionPolicy, sns:GetTopicAttributes, sns:ListSubscriptionsByTopic, sns:ListTagsForResource, sns:ListTopics
SQS3 of 203 Read; 3 restricted, 3 conditionalsqs:GetQueueAttributes, sqs:ListQueueTags, sqs:ListQueues
Systems Manager10 of 1645 List, 5 Read; 10 restricted, 10 conditionalssm:DescribeAssociation, ssm:DescribeDocument, ssm:DescribePatchBaselines, ssm:GetDefaultPatchBaseline, ssm:GetDocument, ssm:GetPatchBaseline, ssm:ListAssociations, ssm:ListDocuments, ssm:ListResourceDataSync, ssm:ListTagsForResource
Incident Manager Contacts3 of 401 List, 2 Read; 3 restricted, 3 conditionalssm-contacts:GetContact, ssm-contacts:ListContacts, ssm-contacts:ListTagsForResource
Incident Manager3 of 311 List, 2 Read; 3 restricted, 3 conditionalssm-incidents:GetResponsePlan, ssm-incidents:ListResponsePlans, ssm-incidents:ListTagsForResource
Systems Manager Quick Setup2 of 141 List, 1 Read; 2 restricted, 2 conditionalssm-quicksetup:GetConfigurationManager, ssm-quicksetup:ListConfigurationManagers
IAM Identity Center3 of 1261 List, 2 Read; 3 restricted, 3 conditionalsso:DescribeInstance, sso:GetManagedApplicationInstance, sso:ListInstances
Step Functions5 of 373 List, 2 Read; 5 restricted, 5 conditionalstates:DescribeActivity, states:DescribeStateMachine, states:ListActivities, states:ListStateMachines, states:ListTagsForResource
Resource Group Tagging1 of 91 Read; 1 restricted, 1 conditionaltag:GetResources
Timestream3 of 321 List, 2 Read; 3 restricted, 3 conditionaltimestream:DescribeTable, timestream:ListTables, timestream:ListTagsForResource
Transfer14 of 723 List, 11 Read; 14 restricted, 14 conditionaltransfer:DescribeAgreement, transfer:DescribeCertificate, transfer:DescribeConnector, transfer:DescribeProfile, transfer:DescribeServer, transfer:DescribeUser, transfer:DescribeWorkflow, transfer:ListAgreements, transfer:ListCertificates, transfer:ListConnectors, transfer:ListProfiles, transfer:ListServers and 2 more
Verified Permissions6 of 312 List, 4 Read; 6 restricted, 6 conditionalverifiedpermissions:GetIdentitySource, verifiedpermissions:GetPolicyStore, verifiedpermissions:GetSchema, verifiedpermissions:ListIdentitySources, verifiedpermissions:ListPolicyStores, verifiedpermissions:ListTagsForResource
WAF V29 of 644 List, 5 Read; 9 restricted, 9 conditionalwafv2:GetIPSet, wafv2:GetRegexPatternSet, wafv2:GetRuleGroup, wafv2:GetWebACL, wafv2:ListIPSets, wafv2:ListRegexPatternSets, wafv2:ListRuleGroups, wafv2:ListTagsForResource, wafv2:ListWebACLs

The full action list is in actions.json.

Data-plane actions (18)

By access level: 13 List, 5 Read.

Data-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
Bedrock6 of 373 List, 3 Read; 6 restricted, 6 conditionalbedrock:GetAgentMemory, bedrock:GetInvocationStep, bedrock:GetSession, bedrock:ListInvocationSteps, bedrock:ListInvocations, bedrock:ListSessions
Bedrock-Agentcore8 of 627 List, 1 Read; 8 restricted, 8 conditionalbedrock-agentcore:GetAgentCard, bedrock-agentcore:ListActors, bedrock-agentcore:ListBrowserSessions, bedrock-agentcore:ListCodeInterpreterSessions, bedrock-agentcore:ListEvents, bedrock-agentcore:ListMemoryExtractionJobs, bedrock-agentcore:ListMemoryRecords, bedrock-agentcore:ListSessions
CloudWatch2 of 51 List, 1 Read; 2 restricted, 2 conditionalcloudwatch:GetMetricData, cloudwatch:ListMetrics
S31 of 251 List; 1 restricted, 1 conditionals3:ListBucket
Timestream1 of 51 List; 1 restricted, 1 conditionaltimestream:DescribeEndpoints

The full action list is in actions.json.

Excluded and conditional actions

  • apigateway:GET (deny-conditional, statement 3): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: No (service-linked role policy).

Why this tier

  • Grants 12 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AssuranceComplianceRead",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:GetAnalyzer",
        "access-analyzer:ListAnalyzers",
        "access-analyzer:ListArchiveRules",
        "acm-pca:DescribeCertificateAuthority",
        "acm-pca:GetCertificateAuthorityCertificate",
        "acm-pca:GetCertificateAuthorityCsr",
        "acm-pca:ListCertificateAuthorities",
        "acm-pca:ListTags",
        "acm:DescribeCertificate",
        "acm:ListCertificates",
        "acm:ListTagsForCertificate",
        "amplify:GetApp",
        "amplify:GetBranch",
        "amplify:ListApps",
        "amplify:ListBranches",
        "amplify:ListTagsForResource",
        "aoss:BatchGetCollection",
        "aoss:BatchGetLifecyclePolicy",
        "aoss:BatchGetVpcEndpoint",
        "aoss:GetAccessPolicy",
        "aoss:GetSecurityConfig",
        "aoss:GetSecurityPolicy",
        "aoss:ListAccessPolicies",
        "aoss:ListCollections",
        "aoss:ListLifecyclePolicies",
        "aoss:ListSecurityConfigs",
        "aoss:ListSecurityPolicies",
        "aoss:ListTagsForResource",
        "aoss:ListVpcEndpoints",
        "app-integrations:GetApplication",
        "app-integrations:GetDataIntegration",
        "app-integrations:GetEventIntegration",
        "app-integrations:ListApplications",
        "app-integrations:ListDataIntegrations",
        "app-integrations:ListEventIntegrations",
        "app-integrations:ListTagsForResource",
        "appconfig:GetConfigurationProfile",
        "appconfig:GetDeploymentStrategy",
        "appconfig:GetEnvironment",
        "appconfig:GetExtension",
        "appconfig:GetExtensionAssociation",
        "appconfig:ListConfigurationProfiles",
        "appconfig:ListDeploymentStrategies",
        "appconfig:ListEnvironments",
        "appconfig:ListExtensionAssociations",
        "appconfig:ListExtensions",
        "appconfig:ListHostedConfigurationVersions",
        "appconfig:ListTagsForResource",
        "appflow:DescribeFlow",
        "appflow:ListFlows",
        "appflow:ListTagsForResource",
        "application-signals:GetServiceLevelObjective",
        "application-signals:ListServiceLevelObjectiveExclusionWindows",
        "application-signals:ListServiceLevelObjectives",
        "application-signals:ListTagsForResource",
        "apprunner:DescribeService",
        "apprunner:DescribeVpcConnector",
        "apprunner:ListServices",
        "apprunner:ListVpcConnectors",
        "appstream:DescribeAppBlockBuilders",
        "appstream:DescribeAppBlocks",
        "appstream:DescribeDirectoryConfigs",
        "appstream:DescribeFleets",
        "appstream:DescribeStacks",
        "appstream:ListTagsForResource",
        "appsync:GetApi",
        "appsync:GetApiCache",
        "appsync:GetDataSource",
        "appsync:GetGraphqlApi",
        "appsync:ListApis",
        "appsync:ListDataSources",
        "appsync:ListGraphqlApis",
        "appsync:ListTagsForResource",
        "aps:DescribeAlertManagerDefinition",
        "aps:DescribeLoggingConfiguration",
        "aps:DescribeQueryLoggingConfiguration",
        "aps:DescribeRuleGroupsNamespace",
        "aps:DescribeWorkspace",
        "aps:DescribeWorkspaceConfiguration",
        "aps:ListRuleGroupsNamespaces",
        "aps:ListTagsForResource",
        "aps:ListWorkspaces",
        "arc-zonal-shift:GetAutoshiftObserverNotificationStatus",
        "athena:GetDataCatalog",
        "athena:GetPreparedStatement",
        "athena:GetWorkGroup",
        "athena:ListDataCatalogs",
        "athena:ListPreparedStatements",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "auditmanager:GetAssessment",
        "auditmanager:ListAssessments",
        "auditmanager:ListTagsForResource",
        "autoscaling:DescribeAccountLimits",
        "autoscaling:DescribeAccountSettings",
        "autoscaling:DescribeAdjustmentTypes",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribeAutoScalingInstances",
        "autoscaling:DescribeAutoScalingNotificationTypes",
        "autoscaling:DescribeInstanceRefreshes",
        "autoscaling:DescribeLaunchConfigurations",
        "autoscaling:DescribeLifecycleHooks",
        "autoscaling:DescribeLifecycleHookTypes",
        "autoscaling:DescribeLoadBalancers",
        "autoscaling:DescribeLoadBalancerTargetGroups",
        "autoscaling:DescribeMetricCollectionTypes",
        "autoscaling:DescribeNotificationConfigurations",
        "autoscaling:DescribePolicies",
        "autoscaling:DescribeScalingActivities",
        "autoscaling:DescribeScalingProcessTypes",
        "autoscaling:DescribeScheduledActions",
        "autoscaling:DescribeTags",
        "autoscaling:DescribeTerminationPolicyTypes",
        "autoscaling:DescribeTrafficSources",
        "autoscaling:DescribeWarmPool",
        "b2bi:GetCapability",
        "b2bi:GetProfile",
        "b2bi:GetTransformer",
        "b2bi:ListCapabilities",
        "b2bi:ListProfiles",
        "b2bi:ListTagsForResource",
        "b2bi:ListTransformers",
        "backup-gateway:GetHypervisor",
        "backup-gateway:ListHypervisors",
        "backup-gateway:ListTagsForResource",
        "backup:DescribeBackupVault",
        "backup:DescribeReportPlan",
        "backup:GetBackupPlan",
        "backup:GetBackupSelection",
        "backup:GetBackupVaultAccessPolicy",
        "backup:GetBackupVaultNotifications",
        "backup:GetRestoreTestingPlan",
        "backup:GetRestoreTestingSelection",
        "backup:ListBackupPlans",
        "backup:ListBackupSelections",
        "backup:ListBackupVaults",
        "backup:ListReportPlans",
        "backup:ListRestoreTestingPlans",
        "backup:ListRestoreTestingSelections",
        "backup:ListTags",
        "batch:DescribeComputeEnvironments",
        "batch:DescribeConsumableResource",
        "batch:DescribeJobQueues",
        "batch:DescribeSchedulingPolicies",
        "batch:ListConsumableResources",
        "batch:ListSchedulingPolicies",
        "bcm-data-exports:GetExport",
        "bcm-data-exports:ListExports",
        "bcm-data-exports:ListTagsForResource",
        "bedrock-agentcore:GetAgentCard",
        "bedrock-agentcore:GetAgentRuntime",
        "bedrock-agentcore:GetAgentRuntimeEndpoint",
        "bedrock-agentcore:GetBrowser",
        "bedrock-agentcore:GetCodeInterpreter",
        "bedrock-agentcore:GetEvaluator",
        "bedrock-agentcore:GetGateway",
        "bedrock-agentcore:GetGatewayTarget",
        "bedrock-agentcore:GetMemory",
        "bedrock-agentcore:GetOnlineEvaluationConfig",
        "bedrock-agentcore:GetPolicy",
        "bedrock-agentcore:GetPolicyEngine",
        "bedrock-agentcore:GetResourcePolicy",
        "bedrock-agentcore:GetTokenVault",
        "bedrock-agentcore:GetWorkloadIdentity",
        "bedrock-agentcore:ListActors",
        "bedrock-agentcore:ListAgentRuntimeEndpoints",
        "bedrock-agentcore:ListAgentRuntimes",
        "bedrock-agentcore:ListAgentRuntimeVersions",
        "bedrock-agentcore:ListApiKeyCredentialProviders",
        "bedrock-agentcore:ListBrowserProfiles",
        "bedrock-agentcore:ListBrowsers",
        "bedrock-agentcore:ListBrowserSessions",
        "bedrock-agentcore:ListCodeInterpreters",
        "bedrock-agentcore:ListCodeInterpreterSessions",
        "bedrock-agentcore:ListEvaluators",
        "bedrock-agentcore:ListEvents",
        "bedrock-agentcore:ListGateways",
        "bedrock-agentcore:ListGatewayTargets",
        "bedrock-agentcore:ListMemories",
        "bedrock-agentcore:ListMemoryExtractionJobs",
        "bedrock-agentcore:ListMemoryRecords",
        "bedrock-agentcore:ListOauth2CredentialProviders",
        "bedrock-agentcore:ListOnlineEvaluationConfigs",
        "bedrock-agentcore:ListPolicies",
        "bedrock-agentcore:ListPolicyEngines",
        "bedrock-agentcore:ListSessions",
        "bedrock-agentcore:ListTagsForResource",
        "bedrock-agentcore:ListWorkloadIdentities",
        "bedrock:GetAgent",
        "bedrock:GetAgentActionGroup",
        "bedrock:GetAgentAlias",
        "bedrock:GetAgentCollaborator",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:GetAgentMemory",
        "bedrock:GetAgentVersion",
        "bedrock:GetCustomModel",
        "bedrock:GetDataSource",
        "bedrock:GetFlow",
        "bedrock:GetFlowAlias",
        "bedrock:GetFlowExecution",
        "bedrock:GetFlowVersion",
        "bedrock:GetFoundationModel",
        "bedrock:GetGuardrail",
        "bedrock:GetIngestionJob",
        "bedrock:GetInvocationStep",
        "bedrock:GetKnowledgeBase",
        "bedrock:GetModelInvocationLoggingConfiguration",
        "bedrock:GetPrompt",
        "bedrock:GetSession",
        "bedrock:ListAgentActionGroups",
        "bedrock:ListAgentAliases",
        "bedrock:ListAgentCollaborators",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:ListAgents",
        "bedrock:ListAgentVersions",
        "bedrock:ListAutomatedReasoningPolicies",
        "bedrock:ListBlueprints",
        "bedrock:ListCustomModels",
        "bedrock:ListDataSources",
        "bedrock:ListEvaluationJobs",
        "bedrock:ListFlowAliases",
        "bedrock:ListFlowExecutionEvents",
        "bedrock:ListFlowExecutions",
        "bedrock:ListFlows",
        "bedrock:ListFlowVersions",
        "bedrock:ListFoundationModels",
        "bedrock:ListGuardrails",
        "bedrock:ListIngestionJobs",
        "bedrock:ListInvocations",
        "bedrock:ListInvocationSteps",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListPrompts",
        "bedrock:ListSessions",
        "bedrock:ListTagsForResource",
        "bedrock:ValidateFlowDefinition",
        "budgets:DescribeBudgetAction",
        "budgets:DescribeBudgetActionsForAccount",
        "budgets:DescribeBudgetActionsForBudget",
        "budgets:ListTagsForResource",
        "ce:DescribeCostCategoryDefinition",
        "ce:ListCostCategoryDefinitions",
        "ce:ListTagsForResource",
        "cleanrooms-ml:GetTrainingDataset",
        "cleanrooms-ml:ListTrainingDatasets",
        "cleanrooms:GetAnalysisTemplate",
        "cleanrooms:GetCollaboration",
        "cleanrooms:GetConfiguredTable",
        "cleanrooms:GetConfiguredTableAnalysisRule",
        "cleanrooms:GetMembership",
        "cleanrooms:ListAnalysisTemplates",
        "cleanrooms:ListCollaborations",
        "cleanrooms:ListConfiguredTables",
        "cleanrooms:ListMembers",
        "cleanrooms:ListMemberships",
        "cleanrooms:ListTagsForResource",
        "cloud9:DescribeEnvironments",
        "cloud9:ListEnvironments",
        "cloud9:ListTagsForResource",
        "cloudformation:DescribeStackInstance",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackSet",
        "cloudformation:DescribeType",
        "cloudformation:GetResource",
        "cloudformation:GetStackPolicy",
        "cloudformation:GetTemplate",
        "cloudformation:ListResources",
        "cloudformation:ListStackInstances",
        "cloudformation:ListStackResources",
        "cloudformation:ListStacks",
        "cloudformation:ListStackSets",
        "cloudformation:ListTypes",
        "cloudfront:DescribeKeyValueStore",
        "cloudfront:GetDistribution",
        "cloudfront:GetDistributionConfig",
        "cloudfront:GetPublicKey",
        "cloudfront:GetRealtimeLogConfig",
        "cloudfront:ListDistributions",
        "cloudfront:ListKeyValueStores",
        "cloudfront:ListPublicKeys",
        "cloudfront:ListRealtimeLogConfigs",
        "cloudfront:ListTagsForResource",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetChannel",
        "cloudtrail:GetEventConfiguration",
        "cloudtrail:GetEventDataStore",
        "cloudtrail:GetEventSelectors",
        "cloudtrail:GetInsightSelectors",
        "cloudtrail:GetQueryResults",
        "cloudtrail:GetResourcePolicy",
        "cloudtrail:GetTrail",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:ListChannels",
        "cloudtrail:ListDashboards",
        "cloudtrail:ListEventDataStores",
        "cloudtrail:ListTags",
        "cloudtrail:ListTrails",
        "cloudtrail:LookupEvents",
        "cloudtrail:StartQuery",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStream",
        "cloudwatch:ListDashboards",
        "cloudwatch:ListManagedInsightRules",
        "cloudwatch:ListMetrics",
        "cloudwatch:ListMetricStreams",
        "cloudwatch:ListTagsForResource",
        "codeartifact:DescribeDomain",
        "codeartifact:DescribePackageGroup",
        "codeartifact:DescribeRepository",
        "codeartifact:GetDomainPermissionsPolicy",
        "codeartifact:GetRepositoryPermissionsPolicy",
        "codeartifact:ListAllowedRepositoriesForGroup",
        "codeartifact:ListDomains",
        "codeartifact:ListPackageGroups",
        "codeartifact:ListRepositories",
        "codeartifact:ListTagsForResource",
        "codebuild:BatchGetReportGroups",
        "codebuild:ListReportGroups",
        "codecommit:GetRepository",
        "codecommit:GetRepositoryTriggers",
        "codedeploy:GetApplication",
        "codedeploy:GetDeployment",
        "codedeploy:GetDeploymentConfig",
        "codedeploy:GetDeploymentGroup",
        "codedeploy:ListApplications",
        "codedeploy:ListDeploymentConfigs",
        "codedeploy:ListDeploymentGroups",
        "codedeploy:ListDeployments",
        "codedeploy:ListTagsForResource",
        "codeguru-profiler:DescribeProfilingGroup",
        "codeguru-profiler:GetNotificationConfiguration",
        "codeguru-profiler:GetPolicy",
        "codeguru-profiler:ListProfilingGroups",
        "codeguru-profiler:ListTagsForResource",
        "codeguru-reviewer:DescribeRepositoryAssociation",
        "codeguru-reviewer:ListRepositoryAssociations",
        "codeguru-reviewer:ListTagsForResource",
        "codepipeline:GetPipeline",
        "codepipeline:GetPipelineState",
        "codepipeline:ListPipelines",
        "codepipeline:ListTagsForResource",
        "cognito-identity:DescribeIdentityPool",
        "cognito-identity:GetIdentityPoolRoles",
        "cognito-identity:GetPrincipalTagAttributeMap",
        "cognito-identity:ListIdentityPools",
        "cognito-identity:ListTagsForResource",
        "cognito-idp:DescribeIdentityProvider",
        "cognito-idp:DescribeResourceServer",
        "cognito-idp:DescribeUserPool",
        "cognito-idp:DescribeUserPoolClient",
        "cognito-idp:DescribeUserPoolDomain",
        "cognito-idp:GetGroup",
        "cognito-idp:GetLogDeliveryConfiguration",
        "cognito-idp:GetUICustomization",
        "cognito-idp:GetUserPoolMfaConfig",
        "cognito-idp:ListGroups",
        "cognito-idp:ListIdentityProviders",
        "cognito-idp:ListResourceServers",
        "cognito-idp:ListUserPoolClients",
        "cognito-idp:ListUserPools",
        "comprehend:DescribeFlywheel",
        "comprehend:ListFlywheels",
        "comprehend:ListTagsForResource",
        "config:DescribeAggregationAuthorizations",
        "config:DescribeComplianceByConfigRule",
        "config:DescribeConfigRules",
        "config:DescribeConfigurationAggregators",
        "config:DescribeConfigurationRecorderStatus",
        "config:DescribeConformancePacks",
        "config:DescribeDeliveryChannels",
        "config:DescribeOrganizationConformancePacks",
        "config:GetComplianceDetailsByConfigRule",
        "config:GetStoredQuery",
        "config:ListConfigurationRecorders",
        "config:ListStoredQueries",
        "config:ListTagsForResource",
        "config:SelectResourceConfig",
        "config:BatchGetResourceConfig",
        "config:ListDiscoveredResources",
        "connect-campaigns:DescribeCampaign",
        "connect-campaigns:ListCampaigns",
        "connect:DescribeInstance",
        "connect:DescribePhoneNumber",
        "connect:DescribePredefinedAttribute",
        "connect:DescribePrompt",
        "connect:DescribeQueue",
        "connect:DescribeQuickConnect",
        "connect:DescribeRoutingProfile",
        "connect:DescribeRule",
        "connect:DescribeSecurityProfile",
        "connect:DescribeUser",
        "connect:GetTaskTemplate",
        "connect:ListInstanceAttributes",
        "connect:ListInstances",
        "connect:ListPhoneNumbersV2",
        "connect:ListPredefinedAttributes",
        "connect:ListPrompts",
        "connect:ListQueueEmailAddresses",
        "connect:ListQueueQuickConnects",
        "connect:ListQueues",
        "connect:ListQuickConnects",
        "connect:ListRoutingProfileManualAssignmentQueues",
        "connect:ListRoutingProfileQueues",
        "connect:ListRoutingProfiles",
        "connect:ListRules",
        "connect:ListSecurityProfileApplications",
        "connect:ListSecurityProfileFlowModules",
        "connect:ListSecurityProfilePermissions",
        "connect:ListSecurityProfiles",
        "connect:ListTaskTemplates",
        "connect:ListUserProficiencies",
        "connect:ListUsers",
        "databrew:DescribeDataset",
        "databrew:DescribeJob",
        "databrew:DescribeRuleset",
        "databrew:DescribeSchedule",
        "databrew:ListDatasets",
        "databrew:ListJobs",
        "databrew:ListRulesets",
        "databrew:ListSchedules",
        "databrew:ListTagsForResource",
        "datasync:DescribeAgent",
        "datasync:DescribeLocationAzureBlob",
        "datasync:DescribeLocationEfs",
        "datasync:DescribeLocationFsxLustre",
        "datasync:DescribeLocationFsxOntap",
        "datasync:DescribeLocationFsxOpenZfs",
        "datasync:DescribeLocationFsxWindows",
        "datasync:DescribeLocationHdfs",
        "datasync:DescribeLocationObjectStorage",
        "datasync:DescribeLocationS3",
        "datasync:DescribeLocationSmb",
        "datasync:DescribeTask",
        "datasync:ListAgents",
        "datasync:ListLocations",
        "datasync:ListTagsForResource",
        "datasync:ListTasks",
        "dax:DescribeParameterGroups",
        "dax:DescribeParameters",
        "deadline:GetFleet",
        "deadline:GetLicenseEndpoint",
        "deadline:GetQueueEnvironment",
        "deadline:GetStorageProfile",
        "deadline:ListFleets",
        "deadline:ListLicenseEndpoints",
        "deadline:ListQueueEnvironments",
        "deadline:ListStorageProfiles",
        "deadline:ListTagsForResource",
        "detective:DescribeOrganizationConfiguration",
        "detective:ListGraphs",
        "detective:ListOrganizationAdminAccount",
        "detective:ListTagsForResource",
        "devicefarm:GetInstanceProfile",
        "devicefarm:GetTestGridProject",
        "devicefarm:ListInstanceProfiles",
        "devicefarm:ListTagsForResource",
        "devicefarm:ListTestGridProjects",
        "dms:DescribeCertificates",
        "dms:DescribeDataMigrations",
        "dms:DescribeEndpoints",
        "dms:DescribeEventSubscriptions",
        "dms:DescribeReplicationSubnetGroups",
        "dms:DescribeReplicationTasks",
        "dms:ListMigrationProjects",
        "dms:ListTagsForResource",
        "ds:DescribeDirectories",
        "dsql:GetCluster",
        "dsql:GetClusterPolicy",
        "dsql:GetVpcEndpointServiceName",
        "dsql:ListClusters",
        "dsql:ListTagsForResource",
        "dynamodb:DescribeBackup",
        "dynamodb:DescribeContinuousBackups",
        "dynamodb:DescribeContributorInsights",
        "dynamodb:DescribeKinesisStreamingDestination",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeTimeToLive",
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListBackups",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAccountVpcEncryptionControl",
        "ec2:DescribeAddresses",
        "ec2:DescribeAddressesAttribute",
        "ec2:DescribeAddressTransfers",
        "ec2:DescribeAggregateIdFormat",
        "ec2:DescribeApplicationStatus",
        "ec2:DescribeApplicationStatusCheckAssociations",
        "ec2:DescribeApplicationStatusChecks",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeAwsNetworkPerformanceMetricSubscriptions",
        "ec2:DescribeBundleTasks",
        "ec2:DescribeByoipCidrs",
        "ec2:DescribeCapacityBlockExtensionHistory",
        "ec2:DescribeCapacityBlockExtensionOfferings",
        "ec2:DescribeCapacityBlockOfferings",
        "ec2:DescribeCapacityBlocks",
        "ec2:DescribeCapacityBlockStatus",
        "ec2:DescribeCapacityManagerDataExports",
        "ec2:DescribeCapacityReservationBillingRequests",
        "ec2:DescribeCapacityReservationCancellationQuotes",
        "ec2:DescribeCapacityReservationFleets",
        "ec2:DescribeCapacityReservations",
        "ec2:DescribeCapacityReservationTopology",
        "ec2:DescribeCarrierGateways",
        "ec2:DescribeClassicLinkInstances",
        "ec2:DescribeClientVpnAuthorizationRules",
        "ec2:DescribeClientVpnConnections",
        "ec2:DescribeClientVpnEndpoints",
        "ec2:DescribeClientVpnRoutes",
        "ec2:DescribeClientVpnTargetNetworks",
        "ec2:DescribeCoipPools",
        "ec2:DescribeConversionTasks",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeDeclarativePoliciesReports",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeElasticGpus",
        "ec2:DescribeExportImageTasks",
        "ec2:DescribeExportTasks",
        "ec2:DescribeFastLaunchImages",
        "ec2:DescribeFastSnapshotRestores",
        "ec2:DescribeFleetHistory",
        "ec2:DescribeFleetInstances",
        "ec2:DescribeFleets",
        "ec2:DescribeFlowLogs",
        "ec2:DescribeFpgaImageAttribute",
        "ec2:DescribeFpgaImages",
        "ec2:DescribeHostReservationOfferings",
        "ec2:DescribeHostReservations",
        "ec2:DescribeHosts",
        "ec2:DescribeIamInstanceProfileAssociations",
        "ec2:DescribeIdentityIdFormat",
        "ec2:DescribeIdFormat",
        "ec2:DescribeImageAttribute",
        "ec2:DescribeImageReferences",
        "ec2:DescribeImages",
        "ec2:DescribeImageUsageReportEntries",
        "ec2:DescribeImageUsageReports",
        "ec2:DescribeImportImageTasks",
        "ec2:DescribeImportSnapshotTasks",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstanceConnectEndpoints",
        "ec2:DescribeInstanceCreditSpecifications",
        "ec2:DescribeInstanceEventNotificationAttributes",
        "ec2:DescribeInstanceEventWindows",
        "ec2:DescribeInstanceImageMetadata",
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceSqlHaHistoryStates",
        "ec2:DescribeInstanceSqlHaStates",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeInstanceTopology",
        "ec2:DescribeInstanceTypeOfferings",
        "ec2:DescribeInstanceTypes",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeIpamByoasn",
        "ec2:DescribeIpamExternalResourceVerificationTokens",
        "ec2:DescribeIpamInternetRegistryAssociations",
        "ec2:DescribeIpamPolicies",
        "ec2:DescribeIpamPoolAllocations",
        "ec2:DescribeIpamPools",
        "ec2:DescribeIpamPrefixListResolvers",
        "ec2:DescribeIpamPrefixListResolverTargets",
        "ec2:DescribeIpamResourceDiscoveries",
        "ec2:DescribeIpamResourceDiscoveryAssociations",
        "ec2:DescribeIpams",
        "ec2:DescribeIpamScopes",
        "ec2:DescribeIpv6Pools",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeLocalGatewayRouteTablePermissions",
        "ec2:DescribeLocalGatewayRouteTables",
        "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
        "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
        "ec2:DescribeLocalGateways",
        "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
        "ec2:DescribeLocalGatewayVirtualInterfaces",
        "ec2:DescribeLockedSnapshots",
        "ec2:DescribeMacHosts",
        "ec2:DescribeMacModificationTasks",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeMovingAddresses",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNetworkInsightsAccessScopeAnalyses",
        "ec2:DescribeNetworkInsightsAccessScopes",
        "ec2:DescribeNetworkInsightsAnalyses",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaceAttribute",
        "ec2:DescribeNetworkInterfacePermissions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeOutpostLags",
        "ec2:DescribePlacementGroups",
        "ec2:DescribePrefixLists",
        "ec2:DescribePrincipalIdFormat",
        "ec2:DescribePublicIpv4Pools",
        "ec2:DescribeRegions",
        "ec2:DescribeReplaceRootVolumeTasks",
        "ec2:DescribeReservedInstances",
        "ec2:DescribeReservedInstancesListings",
        "ec2:DescribeReservedInstancesModifications",
        "ec2:DescribeReservedInstancesOfferings",
        "ec2:DescribeRouteServerEndpoints",
        "ec2:DescribeRouteServerPeers",
        "ec2:DescribeRouteServers",
        "ec2:DescribeRouteTables",
        "ec2:DescribeScheduledInstanceAvailability",
        "ec2:DescribeScheduledInstances",
        "ec2:DescribeSecondaryInterfaces",
        "ec2:DescribeSecondaryNetworks",
        "ec2:DescribeSecondarySubnets",
        "ec2:DescribeSecurityGroupReferences",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSecurityGroupVpcAssociations",
        "ec2:DescribeServiceLinkVirtualInterfaces",
        "ec2:DescribeSnapshotAttribute",
        "ec2:DescribeSnapshots",
        "ec2:DescribeSnapshotTierStatus",
        "ec2:DescribeSpotDatafeedSubscription",
        "ec2:DescribeSpotFleetInstances",
        "ec2:DescribeSpotFleetRequestHistory",
        "ec2:DescribeSpotFleetRequests",
        "ec2:DescribeSpotInstanceRequests",
        "ec2:DescribeSpotPriceHistory",
        "ec2:DescribeStaleSecurityGroups",
        "ec2:DescribeStoreImageTasks",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeTrafficMirrorFilterRules",
        "ec2:DescribeTrafficMirrorFilters",
        "ec2:DescribeTrafficMirrorSessions",
        "ec2:DescribeTrafficMirrorTargets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnectPeers",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayMeteringPolicies",
        "ec2:DescribeTransitGatewayMulticastDomains",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayPolicyTables",
        "ec2:DescribeTransitGatewayRouteTableAnnouncements",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTrunkInterfaceAssociations",
        "ec2:DescribeVerifiedAccessEndpoints",
        "ec2:DescribeVerifiedAccessGroups",
        "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
        "ec2:DescribeVerifiedAccessInstances",
        "ec2:DescribeVerifiedAccessInstanceWebAclAssociations",
        "ec2:DescribeVerifiedAccessTrustProviders",
        "ec2:DescribeVolumeAttribute",
        "ec2:DescribeVolumes",
        "ec2:DescribeVolumesModifications",
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVpcBlockPublicAccessExclusions",
        "ec2:DescribeVpcBlockPublicAccessOptions",
        "ec2:DescribeVpcClassicLink",
        "ec2:DescribeVpcClassicLinkDnsSupport",
        "ec2:DescribeVpcEncryptionControls",
        "ec2:DescribeVpcEndpointAssociations",
        "ec2:DescribeVpcEndpointConnectionNotifications",
        "ec2:DescribeVpcEndpointConnections",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpointServicePermissions",
        "ec2:DescribeVpcEndpointServices",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConcentrators",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetEbsDefaultKmsKeyId",
        "ec2:GetEbsEncryptionByDefault",
        "ec2:GetIpamPoolAllocations",
        "ec2:GetIpamPoolCidrs",
        "ec2:GetNetworkInsightsAccessScopeContent",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ecr:DescribeImages",
        "ecr:DescribeImageScanFindings",
        "ecr:DescribePullThroughCacheRules",
        "ecr:DescribeRegistry",
        "ecr:DescribeRepositories",
        "ecr:DescribeRepositoryCreationTemplates",
        "ecr:GetLifecyclePolicy",
        "ecr:GetRegistryPolicy",
        "ecr:GetRegistryScanningConfiguration",
        "ecr:GetRepositoryPolicy",
        "ecr:ListImages",
        "ecr:ListTagsForResource",
        "ecs:DescribeCapacityProviders",
        "ecs:DescribeClusters",
        "ecs:DescribeContainerInstances",
        "ecs:DescribeDaemon",
        "ecs:DescribeServices",
        "ecs:DescribeTaskDefinition",
        "ecs:DescribeTasks",
        "ecs:DescribeTaskSets",
        "ecs:ListClusters",
        "ecs:ListContainerInstances",
        "ecs:ListDaemons",
        "ecs:ListServices",
        "ecs:ListTagsForResource",
        "ecs:ListTaskDefinitionFamilies",
        "ecs:ListTaskDefinitions",
        "ecs:ListTasks",
        "eks:DescribeAccessEntry",
        "eks:DescribeAddon",
        "eks:DescribeAddonVersions",
        "eks:DescribeCapability",
        "eks:DescribeCluster",
        "eks:DescribeFargateProfile",
        "eks:DescribeIdentityProviderConfig",
        "eks:DescribeNodegroup",
        "eks:DescribePodIdentityAssociation",
        "eks:DescribeUpdate",
        "eks:ListAccessEntries",
        "eks:ListAddons",
        "eks:ListAssociatedAccessPolicies",
        "eks:ListCapabilities",
        "eks:ListClusters",
        "eks:ListFargateProfiles",
        "eks:ListIdentityProviderConfigs",
        "eks:ListNodegroups",
        "eks:ListPodIdentityAssociations",
        "eks:ListTagsForResource",
        "elasticache:DescribeCacheParameterGroups",
        "elasticache:DescribeCacheParameters",
        "elasticache:DescribeCacheSubnetGroups",
        "elasticache:DescribeUserGroups",
        "elasticache:DescribeUsers",
        "elasticache:ListTagsForResource",
        "elasticbeanstalk:DescribeConfigurationSettings",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticbeanstalk:ListTagsForResource",
        "elasticfilesystem:DescribeAccessPoints",
        "elasticfilesystem:DescribeBackupPolicy",
        "elasticfilesystem:DescribeFileSystemPolicy",
        "elasticfilesystem:DescribeFileSystems",
        "elasticfilesystem:DescribeLifecycleConfiguration",
        "elasticfilesystem:DescribeMountTargets",
        "elasticfilesystem:DescribeMountTargetSecurityGroups",
        "elasticfilesystem:DescribeReplicationConfigurations",
        "elasticfilesystem:ListTagsForResource",
        "elasticloadbalancing:DescribeCapacityReservation",
        "elasticloadbalancing:DescribeListenerAttributes",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancerPolicies",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticmapreduce:DescribeSecurityConfiguration",
        "elasticmapreduce:DescribeStudio",
        "elasticmapreduce:ListSecurityConfigurations",
        "elasticmapreduce:ListStudios",
        "emr-containers:DescribeVirtualCluster",
        "emr-containers:ListVirtualClusters",
        "emr-serverless:GetApplication",
        "emr-serverless:ListApplications",
        "entityresolution:GetIdMappingWorkflow",
        "entityresolution:GetMatchingWorkflow",
        "entityresolution:GetSchemaMapping",
        "entityresolution:ListIdMappingWorkflows",
        "entityresolution:ListMatchingWorkflows",
        "entityresolution:ListSchemaMappings",
        "entityresolution:ListTagsForResource",
        "es:DescribeDomain",
        "es:ListTags",
        "events:DescribeApiDestination",
        "events:DescribeArchive",
        "events:DescribeConnection",
        "events:DescribeEndpoint",
        "events:DescribeEventBus",
        "events:DescribeRule",
        "events:ListApiDestinations",
        "events:ListArchives",
        "events:ListConnections",
        "events:ListEndpoints",
        "events:ListEventBuses",
        "events:ListRules",
        "events:ListTagsForResource",
        "events:ListTargetsByRule",
        "firehose:DescribeDeliveryStream",
        "firehose:ListDeliveryStreams",
        "firehose:ListTagsForDeliveryStream",
        "fis:GetExperimentTemplate",
        "fis:ListExperimentTemplates",
        "fis:ListTagsForResource",
        "forecast:DescribeDataset",
        "forecast:DescribeDatasetGroup",
        "forecast:ListDatasetGroups",
        "forecast:ListDatasets",
        "frauddetector:GetVariables",
        "frauddetector:ListTagsForResource",
        "gamelift:DescribeAlias",
        "gamelift:DescribeBuild",
        "gamelift:DescribeContainerFleet",
        "gamelift:DescribeContainerGroupDefinition",
        "gamelift:DescribeFleetLocationAttributes",
        "gamelift:DescribeFleetLocationCapacity",
        "gamelift:DescribeGameServerGroup",
        "gamelift:DescribeGameSessionQueues",
        "gamelift:DescribeMatchmakingConfigurations",
        "gamelift:DescribeMatchmakingRuleSets",
        "gamelift:DescribeScalingPolicies",
        "gamelift:ListAliases",
        "gamelift:ListBuilds",
        "gamelift:ListContainerFleets",
        "gamelift:ListContainerGroupDefinitions",
        "gamelift:ListGameServerGroups",
        "gamelift:ListLocations",
        "gamelift:ListTagsForResource",
        "geo:DescribeGeofenceCollection",
        "geo:DescribeKey",
        "geo:DescribeMap",
        "geo:DescribePlaceIndex",
        "geo:DescribeRouteCalculator",
        "geo:DescribeTracker",
        "geo:ListGeofenceCollections",
        "geo:ListKeys",
        "geo:ListMaps",
        "geo:ListPlaceIndexes",
        "geo:ListRouteCalculators",
        "geo:ListTrackers",
        "globalaccelerator:DescribeAccelerator",
        "globalaccelerator:DescribeAcceleratorAttributes",
        "globalaccelerator:DescribeEndpointGroup",
        "globalaccelerator:DescribeListener",
        "globalaccelerator:ListAccelerators",
        "globalaccelerator:ListEndpointGroups",
        "globalaccelerator:ListListeners",
        "globalaccelerator:ListTagsForResource",
        "glue:GetClassifier",
        "glue:GetClassifiers",
        "glue:GetCrawler",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetJob",
        "glue:GetMLTransform",
        "glue:GetMLTransforms",
        "glue:GetRegistry",
        "glue:GetTags",
        "glue:GetWorkflow",
        "glue:ListCrawlers",
        "glue:ListJobs",
        "glue:ListMLTransforms",
        "glue:ListRegistries",
        "glue:ListWorkflows",
        "grafana:DescribeWorkspace",
        "grafana:DescribeWorkspaceAuthentication",
        "grafana:DescribeWorkspaceConfiguration",
        "grafana:ListTagsForResource",
        "grafana:ListWorkspaces",
        "greengrass:DescribeComponent",
        "greengrass:ListComponentVersions",
        "greengrass:ListTagsForResource",
        "groundstation:GetConfig",
        "groundstation:GetDataflowEndpointGroup",
        "groundstation:GetMissionProfile",
        "groundstation:ListConfigs",
        "groundstation:ListDataflowEndpointGroups",
        "groundstation:ListMissionProfiles",
        "groundstation:ListTagsForResource",
        "guardduty:DescribeOrganizationConfiguration",
        "guardduty:GetAdministratorAccount",
        "guardduty:GetDetector",
        "guardduty:GetFilter",
        "guardduty:GetFindings",
        "guardduty:GetIPSet",
        "guardduty:GetMalwareProtectionPlan",
        "guardduty:GetMasterAccount",
        "guardduty:GetMemberDetectors",
        "guardduty:GetMembers",
        "guardduty:GetThreatIntelSet",
        "guardduty:ListDetectors",
        "guardduty:ListFilters",
        "guardduty:ListFindings",
        "guardduty:ListIPSets",
        "guardduty:ListMalwareProtectionPlans",
        "guardduty:ListMembers",
        "guardduty:ListOrganizationAdminAccounts",
        "guardduty:ListTagsForResource",
        "guardduty:ListThreatEntitySets",
        "guardduty:ListThreatIntelSets",
        "guardduty:ListTrustedEntitySets",
        "iam:GenerateCredentialReport",
        "iam:GetAccessKeyLastUsed",
        "iam:GetAccountPasswordPolicy",
        "iam:GetAccountSummary",
        "iam:GetCredentialReport",
        "iam:GetGroup",
        "iam:GetGroupPolicy",
        "iam:GetInstanceProfile",
        "iam:GetLoginProfile",
        "iam:GetOpenIDConnectProvider",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:GetSAMLProvider",
        "iam:GetServerCertificate",
        "iam:GetUser",
        "iam:GetUserPolicy",
        "iam:ListAccessKeys",
        "iam:ListAccountAliases",
        "iam:ListAttachedGroupPolicies",
        "iam:ListAttachedRolePolicies",
        "iam:ListAttachedUserPolicies",
        "iam:ListEntitiesForPolicy",
        "iam:ListGroupPolicies",
        "iam:ListGroups",
        "iam:ListGroupsForUser",
        "iam:ListInstanceProfiles",
        "iam:ListMFADevices",
        "iam:ListOpenIDConnectProviders",
        "iam:ListPolicies",
        "iam:ListPolicyVersions",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "iam:ListRoleTags",
        "iam:ListSAMLProviders",
        "iam:ListServerCertificates",
        "iam:ListUserPolicies",
        "iam:ListUsers",
        "iam:ListVirtualMFADevices",
        "identitystore:DescribeGroup",
        "identitystore:DescribeUser",
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:ListUsers",
        "imagebuilder:GetContainerRecipe",
        "imagebuilder:GetDistributionConfiguration",
        "imagebuilder:GetImagePipeline",
        "imagebuilder:GetImageRecipe",
        "imagebuilder:GetInfrastructureConfiguration",
        "imagebuilder:GetLifecyclePolicy",
        "imagebuilder:ListContainerRecipes",
        "imagebuilder:ListDistributionConfigurations",
        "imagebuilder:ListImagePipelines",
        "imagebuilder:ListImageRecipes",
        "imagebuilder:ListInfrastructureConfigurations",
        "imagebuilder:ListLifecyclePolicies",
        "inspector2:ListFilters",
        "inspector2:ListTagsForResource",
        "internetmonitor:GetMonitor",
        "internetmonitor:ListMonitors",
        "internetmonitor:ListTagsForResource",
        "iot:DescribeAccountAuditConfiguration",
        "iot:DescribeAuthorizer",
        "iot:DescribeBillingGroup",
        "iot:DescribeCACertificate",
        "iot:DescribeCustomMetric",
        "iot:DescribeDomainConfiguration",
        "iot:DescribeFleetMetric",
        "iot:DescribeJobTemplate",
        "iot:DescribeMitigationAction",
        "iot:DescribeProvisioningTemplate",
        "iot:DescribeRoleAlias",
        "iot:DescribeScheduledAudit",
        "iot:DescribeSecurityProfile",
        "iot:DescribeThingGroup",
        "iot:GetPolicy",
        "iot:GetTopicRule",
        "iot:ListAuthorizers",
        "iot:ListBillingGroups",
        "iot:ListCACertificates",
        "iot:ListCustomMetrics",
        "iot:ListDomainConfigurations",
        "iot:ListFleetMetrics",
        "iot:ListJobTemplates",
        "iot:ListMitigationActions",
        "iot:ListPolicies",
        "iot:ListProvisioningTemplates",
        "iot:ListRoleAliases",
        "iot:ListScheduledAudits",
        "iot:ListSecurityProfiles",
        "iot:ListTagsForResource",
        "iot:ListTargetsForSecurityProfile",
        "iot:ListThingGroups",
        "iot:ListTopicRules",
        "iot:ListV2LoggingLevels",
        "iotdeviceadvisor:GetSuiteDefinition",
        "iotdeviceadvisor:ListSuiteDefinitions",
        "iotfleetwise:GetModelManifest",
        "iotfleetwise:GetSignalCatalog",
        "iotfleetwise:ListModelManifestNodes",
        "iotfleetwise:ListModelManifests",
        "iotfleetwise:ListSignalCatalogNodes",
        "iotfleetwise:ListSignalCatalogs",
        "iotfleetwise:ListTagsForResource",
        "iotsitewise:DescribeAsset",
        "iotsitewise:DescribeAssetModel",
        "iotsitewise:DescribeAssetModelCompositeModel",
        "iotsitewise:DescribeAssetModelInterfaceRelationship",
        "iotsitewise:DescribeDashboard",
        "iotsitewise:DescribeGateway",
        "iotsitewise:DescribeGatewayCapabilityConfiguration",
        "iotsitewise:DescribePortal",
        "iotsitewise:DescribeProject",
        "iotsitewise:ListAssetModelCompositeModels",
        "iotsitewise:ListAssetModelProperties",
        "iotsitewise:ListAssetModels",
        "iotsitewise:ListAssetProperties",
        "iotsitewise:ListAssets",
        "iotsitewise:ListAssociatedAssets",
        "iotsitewise:ListDashboards",
        "iotsitewise:ListGateways",
        "iotsitewise:ListPortals",
        "iotsitewise:ListProjectAssets",
        "iotsitewise:ListProjects",
        "iotsitewise:ListTagsForResource",
        "iottwinmaker:GetComponentType",
        "iottwinmaker:GetEntity",
        "iottwinmaker:GetScene",
        "iottwinmaker:GetWorkspace",
        "iottwinmaker:ListComponents",
        "iottwinmaker:ListComponentTypes",
        "iottwinmaker:ListEntities",
        "iottwinmaker:ListProperties",
        "iottwinmaker:ListScenes",
        "iottwinmaker:ListTagsForResource",
        "iottwinmaker:ListWorkspaces",
        "iotwireless:GetDestination",
        "iotwireless:GetDeviceProfile",
        "iotwireless:GetFuotaTask",
        "iotwireless:GetNetworkAnalyzerConfiguration",
        "iotwireless:GetServiceProfile",
        "iotwireless:GetWirelessDevice",
        "iotwireless:GetWirelessGateway",
        "iotwireless:GetWirelessGatewayTaskDefinition",
        "iotwireless:ListDestinations",
        "iotwireless:ListDeviceProfiles",
        "iotwireless:ListFuotaTasks",
        "iotwireless:ListNetworkAnalyzerConfigurations",
        "iotwireless:ListServiceProfiles",
        "iotwireless:ListTagsForResource",
        "iotwireless:ListWirelessDevices",
        "iotwireless:ListWirelessGateways",
        "iotwireless:ListWirelessGatewayTaskDefinitions",
        "ivs:GetChannel",
        "ivs:GetEncoderConfiguration",
        "ivs:GetPlaybackRestrictionPolicy",
        "ivs:GetRecordingConfiguration",
        "ivs:GetStorageConfiguration",
        "ivs:ListChannels",
        "ivs:ListEncoderConfigurations",
        "ivs:ListPlaybackRestrictionPolicies",
        "ivs:ListRecordingConfigurations",
        "ivs:ListStorageConfigurations",
        "ivs:ListTagsForResource",
        "kafka:DescribeCluster",
        "kafka:DescribeClusterV2",
        "kafka:DescribeVpcConnection",
        "kafka:GetClusterPolicy",
        "kafka:ListClusters",
        "kafka:ListClustersV2",
        "kafka:ListScramSecrets",
        "kafka:ListVpcConnections",
        "kafkaconnect:DescribeConnector",
        "kafkaconnect:DescribeCustomPlugin",
        "kafkaconnect:ListConnectors",
        "kafkaconnect:ListCustomPlugins",
        "kafkaconnect:ListTagsForResource",
        "kendra:DescribeIndex",
        "kendra:ListIndices",
        "kendra:ListTagsForResource",
        "kinesis:DescribeStreamSummary",
        "kinesis:GetResourcePolicy",
        "kinesis:ListStreams",
        "kinesis:ListTagsForResource",
        "kinesis:ListTagsForStream",
        "kinesisanalytics:DescribeApplication",
        "kinesisanalytics:ListApplications",
        "kinesisanalytics:ListTagsForResource",
        "kinesisvideo:DescribeSignalingChannel",
        "kinesisvideo:DescribeStream",
        "kinesisvideo:DescribeStreamStorageConfiguration",
        "kinesisvideo:ListSignalingChannels",
        "kinesisvideo:ListStreams",
        "kinesisvideo:ListTagsForResource",
        "kinesisvideo:ListTagsForStream",
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:GetKeyRotationStatus",
        "kms:ListAliases",
        "kms:ListGrants",
        "kms:ListKeys",
        "kms:ListResourceTags",
        "lakeformation:DescribeLakeFormationIdentityCenterConfiguration",
        "lakeformation:DescribeResource",
        "lakeformation:ListResources",
        "lambda:GetAlias",
        "lambda:GetCodeSigningConfig",
        "lambda:GetEventSourceMapping",
        "lambda:GetFunction",
        "lambda:GetFunctionCodeSigningConfig",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionRecursionConfig",
        "lambda:GetFunctionScalingConfig",
        "lambda:GetFunctionUrlConfig",
        "lambda:GetLayerVersionPolicy",
        "lambda:GetPolicy",
        "lambda:GetProvisionedConcurrencyConfig",
        "lambda:GetRuntimeManagementConfig",
        "lambda:ListAliases",
        "lambda:ListCapacityProviders",
        "lambda:ListCodeSigningConfigs",
        "lambda:ListEventSourceMappings",
        "lambda:ListFunctionEventInvokeConfigs",
        "lambda:ListFunctions",
        "lambda:ListFunctionUrlConfigs",
        "lambda:ListLayers",
        "lambda:ListLayerVersions",
        "lambda:ListProvisionedConcurrencyConfigs",
        "lambda:ListTags",
        "lambda:ListVersionsByFunction",
        "lex:DescribeBot",
        "lex:DescribeBotAlias",
        "lex:DescribeBotReplica",
        "lex:GetBotAlias",
        "lex:ListBotAliases",
        "lex:ListBotLocales",
        "lex:ListBotReplicas",
        "lex:ListBots",
        "lex:ListIntents",
        "lex:ListSlots",
        "lex:ListSlotTypes",
        "lex:ListTagsForResource",
        "license-manager:GetGrant",
        "license-manager:GetLicense",
        "license-manager:ListDistributedGrants",
        "license-manager:ListLicenses",
        "license-manager:ListTagsForResource",
        "lightsail:GetBuckets",
        "lightsail:GetCertificates",
        "lightsail:GetDisk",
        "lightsail:GetDisks",
        "lightsail:GetStaticIp",
        "lightsail:GetStaticIps",
        "logs:DescribeDeliveryDestinations",
        "logs:DescribeDeliverySources",
        "logs:DescribeDestinations",
        "logs:DescribeIndexPolicies",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeResourcePolicies",
        "logs:DescribeSubscriptionFilters",
        "logs:FilterLogEvents",
        "logs:GetDataProtectionPolicy",
        "logs:GetLogDelivery",
        "logs:GetQueryResults",
        "logs:ListLogDeliveries",
        "logs:ListTagsForResource",
        "logs:StartQuery",
        "m2:GetEnvironment",
        "m2:ListEnvironments",
        "m2:ListTagsForResource",
        "macie2:GetCustomDataIdentifier",
        "macie2:GetMacieSession",
        "macie2:ListAutomatedDiscoveryAccounts",
        "macie2:ListCustomDataIdentifiers",
        "mediaconnect:DescribeFlow",
        "mediaconnect:DescribeGateway",
        "mediaconnect:ListFlows",
        "mediaconnect:ListGateways",
        "mediaconnect:ListTagsForResource",
        "medialive:DescribeMultiplexProgram",
        "medialive:GetCloudWatchAlarmTemplate",
        "medialive:GetEventBridgeRuleTemplate",
        "medialive:ListCloudWatchAlarmTemplates",
        "medialive:ListEventBridgeRuleTemplates",
        "medialive:ListMultiplexPrograms",
        "mediapackage-vod:DescribeAsset",
        "mediapackage-vod:DescribePackagingConfiguration",
        "mediapackage-vod:DescribePackagingGroup",
        "mediapackage-vod:ListAssets",
        "mediapackage-vod:ListPackagingConfigurations",
        "mediapackage-vod:ListPackagingGroups",
        "mediapackagev2:GetChannel",
        "mediapackagev2:GetOriginEndpoint",
        "mediapackagev2:ListChannels",
        "mediapackagev2:ListOriginEndpoints",
        "mediatailor:DescribeChannel",
        "mediatailor:DescribeLiveSource",
        "mediatailor:DescribeSourceLocation",
        "mediatailor:GetPlaybackConfiguration",
        "mediatailor:ListChannels",
        "mediatailor:ListLiveSources",
        "mediatailor:ListPlaybackConfigurations",
        "mediatailor:ListSourceLocations",
        "memorydb:DescribeSubnetGroups",
        "memorydb:ListTags",
        "mq:DescribeBroker",
        "mq:DescribeSharedResources",
        "mq:ListBrokers",
        "network-firewall:DescribeFirewall",
        "network-firewall:DescribeFirewallPolicy",
        "network-firewall:DescribeRuleGroup",
        "network-firewall:DescribeTLSInspectionConfiguration",
        "network-firewall:ListFirewallPolicies",
        "network-firewall:ListFirewalls",
        "network-firewall:ListRuleGroups",
        "network-firewall:ListTagsForResource",
        "network-firewall:ListTLSInspectionConfigurations",
        "networkmanager:DescribeGlobalNetworks",
        "networkmanager:GetCustomerGatewayAssociations",
        "networkmanager:GetDevices",
        "networkmanager:GetLinkAssociations",
        "networkmanager:GetLinks",
        "networkmanager:GetSites",
        "networkmanager:GetTransitGatewayRegistrations",
        "omics:GetReferenceStore",
        "omics:GetRunGroup",
        "omics:GetS3AccessPolicy",
        "omics:GetSequenceStore",
        "omics:GetWorkflow",
        "omics:ListReferenceStores",
        "omics:ListRunGroups",
        "omics:ListSequenceStores",
        "omics:ListTagsForResource",
        "omics:ListWorkflows",
        "payment-cryptography:GetAlias",
        "payment-cryptography:GetKey",
        "payment-cryptography:GetResourcePolicy",
        "payment-cryptography:ListAliases",
        "payment-cryptography:ListKeys",
        "payment-cryptography:ListTagsForResource",
        "pca-connector-ad:GetConnector",
        "pca-connector-ad:GetDirectoryRegistration",
        "pca-connector-ad:GetTemplate",
        "pca-connector-ad:ListConnectors",
        "pca-connector-ad:ListDirectoryRegistrations",
        "pca-connector-ad:ListTagsForResource",
        "pca-connector-ad:ListTemplates",
        "pca-connector-scep:GetChallengeMetadata",
        "pca-connector-scep:GetConnector",
        "pca-connector-scep:ListChallengeMetadata",
        "pca-connector-scep:ListConnectors",
        "pca-connector-scep:ListTagsForResource",
        "personalize:DescribeDataset",
        "personalize:DescribeDatasetGroup",
        "personalize:DescribeDatasetImportJob",
        "personalize:DescribeSchema",
        "personalize:DescribeSolution",
        "personalize:ListDatasetGroups",
        "personalize:ListDatasetImportJobs",
        "personalize:ListDatasets",
        "personalize:ListSchemas",
        "personalize:ListSolutions",
        "personalize:ListTagsForResource",
        "profile:GetDomain",
        "profile:GetProfileObjectType",
        "profile:ListDomains",
        "profile:ListProfileObjectTypes",
        "profile:ListTagsForResource",
        "qbusiness:GetApplication",
        "qbusiness:ListApplications",
        "qbusiness:ListTagsForResource",
        "quicksight:DescribeDashboard",
        "quicksight:DescribeDashboardPermissions",
        "quicksight:DescribeDataSet",
        "quicksight:DescribeDataSetPermissions",
        "quicksight:DescribeDataSetRefreshProperties",
        "quicksight:DescribeDataSource",
        "quicksight:DescribeDataSourcePermissions",
        "quicksight:DescribeTemplate",
        "quicksight:DescribeTemplatePermissions",
        "quicksight:DescribeTheme",
        "quicksight:DescribeThemePermissions",
        "quicksight:ListDashboards",
        "quicksight:ListDataSets",
        "quicksight:ListDataSources",
        "quicksight:ListTagsForResource",
        "quicksight:ListTemplates",
        "quicksight:ListThemes",
        "ram:GetResourceShares",
        "rds:DescribeDBClusterParameterGroups",
        "rds:DescribeDBClusterParameters",
        "rds:DescribeDBClusters",
        "rds:DescribeDBClusterSnapshots",
        "rds:DescribeDBEngineVersions",
        "rds:DescribeDBInstanceAutomatedBackups",
        "rds:DescribeDBInstances",
        "rds:DescribeDBParameterGroups",
        "rds:DescribeDBParameters",
        "rds:DescribeDBProxies",
        "rds:DescribeDBProxyEndpoints",
        "rds:DescribeDBShardGroups",
        "rds:DescribeDBSnapshots",
        "rds:DescribeDBSubnetGroups",
        "rds:DescribeEventSubscriptions",
        "rds:DescribeGlobalClusters",
        "rds:DescribeIntegrations",
        "rds:DescribeOptionGroups",
        "rds:ListTagsForResource",
        "redshift:DescribeClusterDbRevisions",
        "redshift:DescribeClusterParameterGroups",
        "redshift:DescribeClusterParameters",
        "redshift:DescribeClusters",
        "redshift:DescribeClusterSubnetGroups",
        "redshift:DescribeEndpointAccess",
        "redshift:DescribeEndpointAuthorization",
        "redshift:DescribeEventSubscriptions",
        "redshift:DescribeIntegrations",
        "redshift:DescribeLoggingStatus",
        "redshift:DescribeScheduledActions",
        "redshift:DescribeTags",
        "redshift:GetResourcePolicy",
        "rekognition:DescribeProjects",
        "rekognition:ListTagsForResource",
        "resiliencehub:DescribeApp",
        "resiliencehub:DescribeAppVersionTemplate",
        "resiliencehub:DescribeResiliencyPolicy",
        "resiliencehub:ListApps",
        "resiliencehub:ListAppVersionResourceMappings",
        "resiliencehub:ListAppVersions",
        "resiliencehub:ListResiliencyPolicies",
        "resiliencehub:ListTagsForResource",
        "resource-explorer-2:GetDefaultView",
        "resource-explorer-2:GetIndex",
        "resource-explorer-2:GetView",
        "resource-explorer-2:ListIndexes",
        "resource-explorer-2:ListViews",
        "resource-explorer-2:Search",
        "resource-groups:GetGroup",
        "resource-groups:GetGroupConfiguration",
        "resource-groups:GetGroupQuery",
        "resource-groups:GetTags",
        "resource-groups:ListGroupResources",
        "resource-groups:ListGroups",
        "rolesanywhere:GetCrl",
        "rolesanywhere:GetProfile",
        "rolesanywhere:GetTrustAnchor",
        "rolesanywhere:ListCrls",
        "rolesanywhere:ListProfiles",
        "rolesanywhere:ListTagsForResource",
        "rolesanywhere:ListTrustAnchors",
        "route53-recovery-control-config:DescribeCluster",
        "route53-recovery-control-config:DescribeControlPanel",
        "route53-recovery-control-config:DescribeRoutingControl",
        "route53-recovery-control-config:DescribeSafetyRule",
        "route53-recovery-control-config:ListClusters",
        "route53-recovery-control-config:ListControlPanels",
        "route53-recovery-control-config:ListRoutingControls",
        "route53-recovery-control-config:ListSafetyRules",
        "route53-recovery-control-config:ListTagsForResource",
        "route53-recovery-readiness:GetCell",
        "route53-recovery-readiness:GetReadinessCheck",
        "route53-recovery-readiness:GetRecoveryGroup",
        "route53-recovery-readiness:GetResourceSet",
        "route53-recovery-readiness:ListCells",
        "route53-recovery-readiness:ListReadinessChecks",
        "route53-recovery-readiness:ListRecoveryGroups",
        "route53-recovery-readiness:ListResourceSets",
        "route53-recovery-readiness:ListTagsForResources",
        "route53:GetDNSSEC",
        "route53:GetHealthCheck",
        "route53:GetHostedZone",
        "route53:ListHealthChecks",
        "route53:ListHostedZones",
        "route53:ListQueryLoggingConfigs",
        "route53:ListTagsForResource",
        "route53profiles:GetProfile",
        "route53profiles:GetProfileAssociation",
        "route53profiles:ListProfileAssociations",
        "route53profiles:ListProfiles",
        "route53profiles:ListTagsForResource",
        "route53resolver:GetFirewallDomainList",
        "route53resolver:GetFirewallRuleGroup",
        "route53resolver:GetFirewallRuleGroupAssociation",
        "route53resolver:GetResolverEndpoint",
        "route53resolver:GetResolverQueryLogConfig",
        "route53resolver:GetResolverQueryLogConfigAssociation",
        "route53resolver:ListFirewallDomainLists",
        "route53resolver:ListFirewallRuleGroupAssociations",
        "route53resolver:ListFirewallRuleGroups",
        "route53resolver:ListFirewallRules",
        "route53resolver:ListResolverEndpointIpAddresses",
        "route53resolver:ListResolverEndpoints",
        "route53resolver:ListResolverQueryLogConfigAssociations",
        "route53resolver:ListResolverQueryLogConfigs",
        "route53resolver:ListTagsForResource",
        "rum:BatchGetRumMetricDefinitions",
        "rum:GetAppMonitor",
        "rum:GetResourcePolicy",
        "rum:ListAppMonitors",
        "rum:ListRumMetricsDestinations",
        "rum:ListTagsForResource",
        "s3:GetAccelerateConfiguration",
        "s3:GetAccessGrant",
        "s3:GetAccessGrantsLocation",
        "s3:GetAccessPoint",
        "s3:GetAccessPointPolicy",
        "s3:GetAccountPublicAccessBlock",
        "s3:GetAnalyticsConfiguration",
        "s3:GetBucketAbac",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketMetadataTableConfiguration",
        "s3:GetBucketNotification",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketOwnershipControls",
        "s3:GetBucketPolicy",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetMetricsConfiguration",
        "s3:GetMultiRegionAccessPoint",
        "s3:GetReplicationConfiguration",
        "s3:GetStorageLensConfiguration",
        "s3:GetStorageLensConfigurationTagging",
        "s3:GetStorageLensGroup",
        "s3:ListAccessGrants",
        "s3:ListAccessGrantsLocations",
        "s3:ListAccessPoints",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListMultiRegionAccessPoints",
        "s3:ListStorageLensConfigurations",
        "s3:ListStorageLensGroups",
        "s3:ListTagsForResource",
        "s3express:GetBucketPolicy",
        "s3express:GetEncryptionConfiguration",
        "s3express:GetInventoryConfiguration",
        "s3express:GetLifecycleConfiguration",
        "s3express:GetMetricsConfiguration",
        "s3express:ListAllMyDirectoryBuckets",
        "s3express:ListTagsForResource",
        "s3tables:GetTableBucket",
        "s3tables:GetTableBucketEncryption",
        "s3tables:GetTableBucketMaintenanceConfiguration",
        "s3tables:GetTableBucketMetricsConfiguration",
        "s3tables:GetTableBucketPolicy",
        "s3tables:GetTableBucketReplication",
        "s3tables:GetTableBucketStorageClass",
        "s3tables:ListTableBuckets",
        "s3tables:ListTagsForResource",
        "s3vectors:GetVectorBucket",
        "s3vectors:GetVectorBucketPolicy",
        "s3vectors:ListTagsForResource",
        "s3vectors:ListVectorBuckets",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:DescribeCluster",
        "sagemaker:DescribeCodeRepository",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeFeatureGroup",
        "sagemaker:DescribeImage",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeInferenceExperiment",
        "sagemaker:DescribeMlflowTrackingServer",
        "sagemaker:DescribeModel",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribeMonitoringSchedule",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:DescribeNotebookInstanceLifecycleConfig",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribeStudioLifecycleConfig",
        "sagemaker:DescribeUserProfile",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:ListAppImageConfigs",
        "sagemaker:ListApps",
        "sagemaker:ListClusters",
        "sagemaker:ListCodeRepositories",
        "sagemaker:ListDomains",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListFeatureGroups",
        "sagemaker:ListInferenceExperiments",
        "sagemaker:ListMlflowTrackingServers",
        "sagemaker:ListModelPackageGroups",
        "sagemaker:ListModels",
        "sagemaker:ListNotebookInstanceLifecycleConfigs",
        "sagemaker:ListNotebookInstances",
        "sagemaker:ListPipelines",
        "sagemaker:ListStudioLifecycleConfigs",
        "sagemaker:ListTags",
        "sagemaker:ListUserProfiles",
        "scheduler:GetScheduleGroup",
        "scheduler:ListScheduleGroups",
        "scheduler:ListTagsForResource",
        "schemas:DescribeDiscoverer",
        "schemas:DescribeRegistry",
        "schemas:DescribeSchema",
        "schemas:GetResourcePolicy",
        "schemas:ListDiscoverers",
        "schemas:ListRegistries",
        "schemas:ListSchemas",
        "schemas:ListSchemaVersions",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:ListSecrets",
        "securityhub:BatchGetSecurityControls",
        "securityhub:DescribeHub",
        "securityhub:GetEnabledStandards",
        "securityhub:GetFindings",
        "securityhub:ListSecurityControlDefinitions",
        "securityhub:ListTagsForResource",
        "servicecatalog:DescribePortfolio",
        "servicecatalog:DescribeProductAsAdmin",
        "servicecatalog:DescribeProvisioningArtifact",
        "servicecatalog:ListPortfolios",
        "servicecatalog:ListProvisioningArtifacts",
        "servicecatalog:ListTagsForResource",
        "servicecatalog:SearchProductsAsAdmin",
        "servicediscovery:GetInstance",
        "servicediscovery:GetNamespace",
        "servicediscovery:GetService",
        "servicediscovery:GetServiceAttributes",
        "servicediscovery:ListInstances",
        "servicediscovery:ListNamespaces",
        "servicediscovery:ListServices",
        "servicediscovery:ListTagsForResource",
        "ses:DescribeConfigurationSet",
        "ses:GetConfigurationSet",
        "ses:GetContactList",
        "ses:GetDedicatedIpPool",
        "ses:GetDedicatedIps",
        "ses:GetEmailTemplate",
        "ses:GetTemplate",
        "ses:GetTrafficPolicy",
        "ses:ListConfigurationSets",
        "ses:ListContactLists",
        "ses:ListDedicatedIpPools",
        "ses:ListEmailTemplates",
        "ses:ListReceiptFilters",
        "ses:ListTagsForResource",
        "ses:ListTemplates",
        "ses:ListTrafficPolicies",
        "shield:DescribeProtection",
        "shield:DescribeProtectionGroup",
        "shield:ListProtectionGroups",
        "shield:ListProtections",
        "shield:ListTagsForResource",
        "signer:GetSigningProfile",
        "signer:ListSigningProfiles",
        "sns:GetDataProtectionPolicy",
        "sns:GetTopicAttributes",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTagsForResource",
        "sns:ListTopics",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "sqs:ListQueueTags",
        "ssm-contacts:GetContact",
        "ssm-contacts:ListContacts",
        "ssm-contacts:ListTagsForResource",
        "ssm-incidents:GetResponsePlan",
        "ssm-incidents:ListResponsePlans",
        "ssm-incidents:ListTagsForResource",
        "ssm-quicksetup:GetConfigurationManager",
        "ssm-quicksetup:ListConfigurationManagers",
        "ssm:DescribeAssociation",
        "ssm:DescribeDocument",
        "ssm:DescribePatchBaselines",
        "ssm:GetDefaultPatchBaseline",
        "ssm:GetDocument",
        "ssm:GetPatchBaseline",
        "ssm:ListAssociations",
        "ssm:ListDocuments",
        "ssm:ListResourceDataSync",
        "ssm:ListTagsForResource",
        "sso:DescribeInstance",
        "sso:GetManagedApplicationInstance",
        "sso:ListInstances",
        "states:DescribeActivity",
        "states:DescribeStateMachine",
        "states:ListActivities",
        "states:ListStateMachines",
        "states:ListTagsForResource",
        "tag:GetResources",
        "timestream:DescribeEndpoints",
        "timestream:DescribeTable",
        "timestream:ListTables",
        "timestream:ListTagsForResource",
        "transfer:DescribeAgreement",
        "transfer:DescribeCertificate",
        "transfer:DescribeConnector",
        "transfer:DescribeProfile",
        "transfer:DescribeServer",
        "transfer:DescribeUser",
        "transfer:DescribeWorkflow",
        "transfer:ListAgreements",
        "transfer:ListCertificates",
        "transfer:ListConnectors",
        "transfer:ListProfiles",
        "transfer:ListServers",
        "transfer:ListUsers",
        "transfer:ListWorkflows",
        "verifiedpermissions:GetIdentitySource",
        "verifiedpermissions:GetPolicyStore",
        "verifiedpermissions:GetSchema",
        "verifiedpermissions:ListIdentitySources",
        "verifiedpermissions:ListPolicyStores",
        "verifiedpermissions:ListTagsForResource",
        "wafv2:GetIPSet",
        "wafv2:GetRegexPatternSet",
        "wafv2:GetRuleGroup",
        "wafv2:GetWebACL",
        "wafv2:ListIPSets",
        "wafv2:ListRegexPatternSets",
        "wafv2:ListRuleGroups",
        "wafv2:ListTagsForResource",
        "wafv2:ListWebACLs"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ReadAwsManagedPolicies",
      "Effect": "Allow",
      "Action": [
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListEntitiesForPolicy"
      ],
      "Resource": "arn:*:iam::aws:policy/*"
    },
    {
      "Sid": "ApiGatewayRead",
      "Effect": "Allow",
      "Action": [
        "apigateway:GET"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/account",
        "arn:aws:apigateway:*::/apis",
        "arn:aws:apigateway:*::/apis/*",
        "arn:aws:apigateway:*::/domainnames",
        "arn:aws:apigateway:*::/domainnames/*",
        "arn:aws:apigateway:*::/restapis",
        "arn:aws:apigateway:*::/restapis/*",
        "arn:aws:apigateway:*::/usageplans",
        "arn:aws:apigateway:*::/usageplans/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "DenyApiGatewayKeys",
      "Effect": "Deny",
      "Action": [
        "apigateway:GET"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/apikeys",
        "arn:aws:apigateway:*::/apikeys/*",
        "arn:aws:apigateway:*::/usageplans/*/keys",
        "arn:aws:apigateway:*::/usageplans/*/keys/*"
      ]
    },
    {
      "Sid": "OrganizationsRead",
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:DescribePolicy",
        "organizations:ListAccounts",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListPolicies",
        "organizations:ListTagsForResource",
        "organizations:ListTargetsForPolicy"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AssuranceConfigurationRecorderManagement",
      "Effect": "Allow",
      "Action": [
        "config:DeleteServiceLinkedConfigurationRecorder",
        "config:DescribeConfigurationRecorders",
        "config:PutServiceLinkedConfigurationRecorder"
      ],
      "Resource": "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForAssurance/*"
    },
    {
      "Sid": "AWSConfigServiceLinkedRole",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "config.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AssurancePolicy",
      "Effect": "Allow",
      "Action": [
        "assurance:BatchGetComment",
        "assurance:BatchGetControl",
        "assurance:BatchGetTask",
        "assurance:CreateAnnotation",
        "assurance:CreateComment",
        "assurance:CreateTask",
        "assurance:DeleteAnnotation",
        "assurance:GetAssessment",
        "assurance:GetComment",
        "assurance:GetControl",
        "assurance:GetControlStatus",
        "assurance:GetEnvironment",
        "assurance:GetEvidence",
        "assurance:GetEvidenceContent",
        "assurance:GetProject",
        "assurance:GetTask",
        "assurance:ListAssessmentAnnotations",
        "assurance:ListAssessments",
        "assurance:ListComments",
        "assurance:ListConnectionItems",
        "assurance:ListControlGroups",
        "assurance:ListControlResources",
        "assurance:ListControls",
        "assurance:ListDiscoveredResources",
        "assurance:ListEnabledFrameworks",
        "assurance:ListEvidence",
        "assurance:ListEvidenceAnnotations",
        "assurance:ListProjects",
        "assurance:ListTasks",
        "assurance:PutEvidence",
        "assurance:UpdateAnnotation",
        "assurance:UpdateAssessment",
        "assurance:UpdateTask"
      ],
      "Resource": "arn:aws:assurance:*:*:environment/*"
    }
  ]
}

Version history

Current version v5, edited by AWS on 2026-11-09. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

This policy cannot be attached to users, groups or roles, so there are no attach snippets.

Sources

Pending editorial review. No editorial sources are listed yet.