AWSCloudTrail_FullAccess

AdminAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides full access to AWS CloudTrail.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess
Default version: v3
Created: 2020-10-08
Last edited: 2021-02-22
Services: cloudtrail, dynamodb, iam, kms, lambda, logs, s3, sns

Control-plane actions (89)

By access level: 16 List, 4 Permissions management, 26 Read, 2 Tagging, 41 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudTrail	All 66 actions (see the CloudTrail page)	8 List, 21 Read, 2 Tagging, 35 Write; 0 restricted, 0 conditional	cloudtrail:*
DynamoDB	2 of 68	2 List; 0 restricted, 0 conditional	dynamodb:ListGlobalTables, dynamodb:ListTables
IAM	4 of 190	1 List, 2 Read, 1 Write; 1 restricted, 1 conditional	iam:GetRolePolicy, iam:GetUser, iam:ListRoles, iam:PassRole
KMS	4 of 58	2 List, 2 Write; 0 restricted, 0 conditional	kms:CreateAlias, kms:CreateKey, kms:ListAliases, kms:ListKeys
Lambda	1 of 121	1 List; 0 restricted, 0 conditional	lambda:ListFunctions
CloudWatch Logs	1 of 133	1 Write; 1 restricted, 0 conditional	logs:CreateLogGroup
S3	6 of 155	1 List, 2 Permissions management, 2 Read, 1 Write; 3 restricted, 0 conditional	s3:CreateBucket, s3:GetBucketLocation, s3:GetBucketPolicy, s3:ListAllMyBuckets, s3:PutBucketPolicy, s3:PutBucketPublicAccessBlock
SNS	5 of 40	1 List, 2 Permissions management, 1 Read, 1 Write; 4 restricted, 0 conditional	sns:AddPermission, sns:CreateTopic, sns:GetTopicAttributes, sns:ListTopics, sns:SetTopicAttributes

DynamoDB: 2 actions

dynamodb:ListGlobalTables (List)
dynamodb:ListTables (List)

IAM: 4 actions

iam:GetRolePolicy (Read)
iam:GetUser (Read)
iam:ListRoles (List)
iam:PassRole (Write)

KMS: 4 actions

kms:CreateAlias (Write)
kms:CreateKey (Write)
kms:ListAliases (List)
kms:ListKeys (List)

Lambda: 1 actions

lambda:ListFunctions (List)

CloudWatch Logs: 1 actions

logs:CreateLogGroup (Write)

S3: 6 actions

s3:CreateBucket (Write)
s3:GetBucketLocation (Read)
s3:GetBucketPolicy (Read)
s3:ListAllMyBuckets (List)
s3:PutBucketPolicy (Permissions management)
s3:PutBucketPublicAccessBlock (Permissions management)

SNS: 5 actions

sns:AddPermission (Permissions management)
sns:CreateTopic (Write)
sns:GetTopicAttributes (Read)
sns:ListTopics (List)
sns:SetTopicAttributes (Permissions management)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: cloudtrail (35 of 35).
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:AddPermission",
        "sns:CreateTopic",
        "sns:SetTopicAttributes",
        "sns:GetTopicAttributes"
      ],
      "Resource": [
        "arn:aws:sns:*:*:aws-cloudtrail-logs*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "sns:ListTopics"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:PutBucketPolicy",
        "s3:PutBucketPublicAccessBlock"
      ],
      "Resource": [
        "arn:aws:s3:::aws-cloudtrail-logs*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:GetBucketPolicy"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudtrail:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:aws-cloudtrail-logs*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "iam:GetRolePolicy",
        "iam:GetUser"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "cloudtrail.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:CreateKey",
        "kms:CreateAlias",
        "kms:ListKeys",
        "kms:ListAliases"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:ListFunctions"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:ListGlobalTables",
        "dynamodb:ListTables"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v3, edited by AWS on 2021-02-22. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess

Terraform

resource "aws_iam_role_policy_attachment" "awscloudtrail_fullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSCloudTrail_FullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCloudTrail_FullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.