When should I attach AWSCODAPermissionsBoundary?

The description says AWS CODA uses it when creating IAM roles for delegations, to define the boundary of their permissions. The reference page says you can attach it to your users, groups and roles, and the IAM User Guide says you can use an AWS managed policy to set a permissions boundary.

What does AWSCODAPermissionsBoundary grant?

As a permissions boundary it sets the maximum permissions: every action except iam:CreateRole, iam:CreateUser, iam:DeleteRolePermissionsBoundary, iam:PutRolePermissionsBoundary and sts:AssumeRoot, with iam:CreateRole, iam:CreateUser and iam:PutRolePermissionsBoundary allowed only when the iam:PermissionsBoundary condition is this same boundary. It does not provide permissions on its own.

What are the security risks of AWSCODAPermissionsBoundary?

The boundary allows nearly every action on all resources, so it limits little beyond IAM and STS. It uses NotAction with Allow, which the IAM User Guide warns could grant more permissions than you intended. An AWS update to the policy affects every identity it is attached to.

AWSCODAPermissionsBoundary

High privilegeAdminAWS managedActiveReviewedShow on map Compare

Summary

AWS CODA creates IAM roles for delegations, and uses this policy when creating these roles to define the boundary of their permissions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary
Default version: v1
Created: 2026-11-06
Last edited: 2026-11-06
Services: a2c, a4b, access-analyzer, account, account-access, acm, acm-pca, aco-automation, action-recommendations, activate, agent-registry, agentaccess-mcp, aidevops, aiops, airflow, airflow-serverless, amplify, amplifybackend, amplifyuibuilder, aoss, apigateway, app-integrations, appconfig, appfabric, appflow, application-autoscaling, application-signals, application-signals-mcp, application-transformation, applicationinsights, appmesh, appmesh-preview, apprunner, appstream, appstudio, appsync, apptest, aps, arc-region-switch, arc-zonal-shift, arsenal, artifact, assurance, athena, auditmanager, autoscaling, autoscaling-plans, aws-external-anthropic, aws-marketplace, aws-marketplace-management, aws-portal, awsconnector, b2bi, backup, backup-gateway, backup-search, backup-storage, batch, bcm-dashboards, bcm-data-exports, bcm-pricing-calculator, bcm-recommended-actions, bedrock, bedrock-agentcore, bedrock-mantle, bedrock-websearch, billing, billingconductor, braket, budgets, bugbust, cases, cassandra, ce, chatbot, chime, cleanrooms, cleanrooms-ml, cloud9, clouddirectory, cloudformation, cloudfront, cloudfront-keyvaluestore, cloudhsm, cloudsearch, cloudshell, cloudtrail, cloudtrail-data, cloudwatch, codeartifact, codebuild, codecatalyst, codecommit, codeconnections, codedeploy, codedeploy-commands-secure, codeguru, codeguru-profiler, codeguru-reviewer, codeguru-security, codepipeline, codestar-connections, codestar-notifications, codewhisperer, cognito-identity, cognito-idp, cognito-sync, comprehend, comprehendmedical, compute-optimizer, config, connect, connect-campaigns, consoleapp, consolidatedbilling, continuum, controlcatalog, controltower, cost-optimization-hub, cur, customer-verification, databrew, dataexchange, datapipeline, datasync, datazone, dax, dbqms, deadline, detective, devicefarm, devops-guru, directconnect, discovery, dlm, dms, docdb-elastic, drs, ds, ds-data, dsql, dynamodb, ebs, ec2, ec2-instance-connect, ec2messages, ecr, ecr-public, ecs, ecs-mcp, eks, eks-auth, eks-mcp, elasticache, elasticbeanstalk, elasticfilesystem, elasticloadbalancing, elasticmapreduce, elastictranscoder, elemental-activations, elemental-appliances-software, elemental-inference, elemental-support-cases, elemental-support-content, emr-containers, emr-serverless, end-user-messaging, entityresolution, es, events, eventsbilltoaws, evs, execute-api, finops-agent, finspace, finspace-api, firehose, fis, fms, forecast, frauddetector, freertos, freetier, fsx, gamelift, gameliftstreams, geo, geo-maps, geo-places, geo-routes, glacier, globalaccelerator, glue, grafana, greengrass, groundstation, groundtruthlabeling, guardduty, health, health-agent, healthlake, honeycode, iam, identity-sync, identitystore, identitystore-auth, imagebuilder, importexport, inspector, inspector-scan, inspector2, inspector2-telemetry, interconnect, internetmonitor, invoicing, iot, iot-device-tester, iotanalytics, iotdeviceadvisor, iotfleethub, iotfleetwise, iotjobsdata, iotmanagedintegrations, iotsitewise, iottwinmaker, iotwireless, iq, iq-permission, ivs, ivschat, kafka, kafka-cluster, kafkaconnect, kendra, kendra-ranking, kinesis, kinesisanalytics, kinesisvideo, kms, lakeformation, lambda, launchwizard, lex, license-manager, license-manager-linux-subscriptions, license-manager-user-subscriptions, lightsail, logs, lookoutequipment, lookoutmetrics, lookoutvision, m2, machinelearning, macie2, managedblockchain, managedblockchain-query, mapcredits, marketplacecommerceanalytics, mechanicalturk, mediaconnect, mediaconvert, mediaimport, medialive, mediapackage, mediapackage-vod, mediapackagev2, mediastore, mediatailor, medical-imaging, memorydb, mgh, mgn, migrationhub-orchestrator, migrationhub-strategy, mobileanalytics, mobiletargeting, monitron, mpa, mq, neptune-db, neptune-graph, network-firewall, network-security-director, network-security-manager, networkflowmonitor, networkmanager, networkmanager-chat, networkmonitor, nimble, notifications, notifications-contacts, nova-act, oam, observabilityadmin, odb, omics, one, opensearch, opsworks, opsworks-cm, organizations, osis, outposts, panorama, partnercentral, partnercentral-account-management, payment-cryptography, payments, pca-connector-ad, pca-connector-scep, pcs, personalize, pi, pipes, polly, pricing, pricingplanmanager, private-networks, profile, proton, purchase-orders, q, qapps, qbusiness, qdeveloper, qldb, quicksight, ram, rbin, rds, rds-data, rds-db, redshift, redshift-data, redshift-serverless, refactor-spaces, rekognition, repostspace, researchstudio, resiliencehub, resource-explorer, resource-explorer-2, resource-groups, rhelkb, robomaker, rolesanywhere, route53, route53-recovery-cluster, route53-recovery-control-config, route53-recovery-readiness, route53domains, route53globalresolver, route53profiles, route53resolver, rtbfabric, rum, s3, s3-object-lambda, s3-outposts, s3express, s3files, s3tables, s3vectors, sagemaker, sagemaker-data-science-assistant, sagemaker-geospatial, sagemaker-mlflow, sagemaker-unified-studio-mcp, savingsplans, scheduler, schemas, scn, sdb, secretsmanager, security-ir, securityagent, securityhub, securitylake, serverlessrepo, servicecatalog, servicediscovery, serviceextract, servicequotas, ses, shield, signer, signin, simspaceweaver, sms, sms-voice, snow-device-management, snowball, sns, social-messaging, sqlworkbench, sqs, ssm, ssm-contacts, ssm-guiconnect, ssm-incidents, ssm-quicksetup, ssm-sap, ssmmessages, sso, sso-directory, sso-oauth, startups, states, storagegateway, sts, support, support-console, supportapp, supportauthz, supportplans, sustainability, swf, synthetics, tag, tax, textract, thinclient, timestream, timestream-influxdb, tiros, tnb, transcribe, transfer, transform, transform-custom, translate, trustedadvisor, ts, user-subscriptions, uxc, vendor-insights, verified-access, verifiedpermissions, voiceid, vpc-lattice, vpc-lattice-svcs, vpce, waf, waf-regional, wafv2, wam, wellarchitected, wickr, wisdom, workdocs, worklink, workmail, workmailmessageflow, workspaces, workspaces-instances, workspaces-web, xray

Control-plane actions (22043)

By access level: 3723 List, 430 Permissions management, 5814 Read, 717 Tagging, 11359 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
App2Container	All 4 actions (see the App2Container page)	2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Alexa for Business	All 96 actions (see the Alexa for Business page)	17 List, 16 Read, 2 Tagging, 61 Write; 0 restricted, 0 conditional	NotAction:0
Access Analyzer	All 37 actions (see the Access Analyzer page)	3 List, 17 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Account	All 20 actions (see the Account page)	1 List, 7 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
Account access manager	All 11 actions (see the Account access manager page)	2 List, 3 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Certificate Manager	All 42 actions (see the Certificate Manager page)	7 List, 11 Read, 4 Tagging, 20 Write; 0 restricted, 0 conditional	NotAction:0
Private Certificate Authority	All 23 actions (see the Private Certificate Authority page)	1 List, 4 Permissions management, 8 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Compute Optimizer Automation	All 23 actions (see the Compute Optimizer Automation page)	10 List, 3 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Action Recommendations	All 1 actions (see the Action Recommendations page)	1 List; 0 restricted, 0 conditional	NotAction:0
Activate	All 8 actions (see the Activate page)	6 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Agent Registry	All 19 actions (see the Agent Registry page)	3 List, 4 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
WorkSpaces AgentAccess MCP	All 25 actions (see the WorkSpaces AgentAccess MCP page)	4 Read, 21 Write; 0 restricted, 0 conditional	NotAction:0
DevOps Agent	All 90 actions (see the DevOps Agent page)	24 List, 1 Permissions management, 19 Read, 2 Tagging, 44 Write; 0 restricted, 0 conditional	NotAction:0
AI Operations	All 33 actions (see the AI Operations page)	7 List, 9 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
MWAA	All 12 actions (see the MWAA page)	1 List, 2 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
MWAA Serverless	All 16 actions (see the MWAA Serverless page)	4 List, 5 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
Amplify	All 41 actions (see the Amplify page)	8 List, 9 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Amplify Admin	All 31 actions (see the Amplify Admin page)	2 List, 7 Read, 22 Write; 0 restricted, 0 conditional	NotAction:0
Amplify UI Builder	All 29 actions (see the Amplify UI Builder page)	5 List, 8 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
OpenSearch Serverless	All 57 actions (see the OpenSearch Serverless page)	10 List, 13 Read, 2 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
API Gateway	All 44 actions (see the API Gateway page)	5 List, 10 Permissions management, 7 Read, 22 Write; 0 restricted, 0 conditional	NotAction:0
AppIntegrations	All 35 actions (see the AppIntegrations page)	7 List, 7 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
AppConfig	All 56 actions (see the AppConfig page)	11 List, 13 Read, 2 Tagging, 30 Write; 0 restricted, 0 conditional	NotAction:0
AppFabric	All 26 actions (see the AppFabric page)	4 List, 5 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
AppFlow	All 31 actions (see the AppFlow page)	3 List, 11 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Application Auto Scaling	All 14 actions (see the Application Auto Scaling page)	1 List, 5 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Application Signals	All 30 actions (see the Application Signals page)	8 List, 9 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Application Signals MCP	All 2 actions (see the Application Signals MCP page)	2 Read; 0 restricted, 0 conditional	NotAction:0
Application Transformation Service	All 14 actions (see the Application Transformation Service page)	6 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch Application Insights	All 34 actions (see the CloudWatch Application Insights page)	7 List, 10 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
App Mesh	All 42 actions (see the App Mesh page)	8 List, 9 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
App Mesh Preview	All 39 actions (see the App Mesh Preview page)	7 List, 9 Read, 23 Write; 0 restricted, 0 conditional	NotAction:0
App Runner	All 42 actions (see the App Runner page)	9 List, 9 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
AppStream 2.0	All 90 actions (see the AppStream 2.0 page)	19 List, 6 Read, 2 Tagging, 63 Write; 0 restricted, 0 conditional	NotAction:0
App Studio	All 5 actions (see the App Studio page)	2 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
AppSync	All 87 actions (see the AppSync page)	13 List, 1 Permissions management, 20 Read, 2 Tagging, 51 Write; 0 restricted, 0 conditional	NotAction:0
Mainframe Modernization Application Testing	All 24 actions (see the Mainframe Modernization Application Testing page)	4 List, 7 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
AMP	All 61 actions (see the AMP page)	4 List, 25 Read, 2 Tagging, 30 Write; 0 restricted, 0 conditional	NotAction:0
ARC Region switch	All 25 actions (see the ARC Region switch page)	7 List, 3 Permissions management, 5 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
ARC Zonal Shift	All 15 actions (see the ARC Zonal Shift page)	3 List, 2 Read, 10 Write; 0 restricted, 0 conditional	NotAction:0
Application Discovery Arsenal	All 1 actions (see the Application Discovery Arsenal page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Artifact	All 24 actions (see the Artifact page)	6 List, 10 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Assurance	All 96 actions (see the Assurance page)	47 Read, 2 Tagging, 47 Write; 0 restricted, 0 conditional	NotAction:0
Athena	All 86 actions (see the Athena page)	13 List, 35 Read, 2 Tagging, 36 Write; 0 restricted, 0 conditional	NotAction:0
Audit Manager	All 62 actions (see the Audit Manager page)	12 List, 19 Read, 2 Tagging, 29 Write; 0 restricted, 0 conditional	NotAction:0
EC2 Auto Scaling	All 68 actions (see the EC2 Auto Scaling page)	22 List, 1 Read, 2 Tagging, 43 Write; 0 restricted, 0 conditional	NotAction:0
Auto Scaling	All 6 actions (see the Auto Scaling page)	3 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
Claude Platform on AWS	All 83 actions (see the Claude Platform on AWS page)	15 List, 16 Read, 2 Tagging, 50 Write; 0 restricted, 0 conditional	NotAction:0
Marketplace	All 97 actions (see the Marketplace page)	27 List, 2 Permissions management, 30 Read, 2 Tagging, 36 Write; 0 restricted, 0 conditional	NotAction:0
Marketplace Portal	All 13 actions (see the Marketplace Portal page)	4 List, 4 Read, 5 Write; 0 restricted, 0 conditional	NotAction:0
Billing Console	All 9 actions (see the Billing Console page)	5 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
Connector Service	All 3 actions (see the Connector Service page)	2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
B2BI	All 23 actions (see the B2BI page)	4 List, 5 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Backup	All 122 actions (see the Backup page)	31 List, 6 Permissions management, 32 Read, 2 Tagging, 51 Write; 0 restricted, 0 conditional	NotAction:0
Backup Gateway	All 27 actions (see the Backup Gateway page)	9 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
Backup Search	All 12 actions (see the Backup Search page)	2 List, 5 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
Backup Storage	All 15 actions (see the Backup Storage page)	15 Write; 0 restricted, 0 conditional	NotAction:0
Batch	All 46 actions (see the Batch page)	5 List, 12 Read, 3 Tagging, 26 Write; 0 restricted, 0 conditional	NotAction:0
Billing and Cost Management Dashboards	All 15 actions (see the Billing and Cost Management Dashboards page)	1 List, 5 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
BillingAndCostManagementDataExports	All 12 actions (see the BillingAndCostManagementDataExports page)	3 List, 4 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
Pricing Calculator	All 36 actions (see the Pricing Calculator page)	10 List, 4 Read, 3 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
BillingAndCostManagementRecommendedActions	All 1 actions (see the BillingAndCostManagementRecommendedActions page)	1 List; 0 restricted, 0 conditional	NotAction:0
Bedrock	All 232 actions (see the Bedrock page)	45 List, 1 Permissions management, 61 Read, 2 Tagging, 123 Write; 0 restricted, 0 conditional	NotAction:0
Bedrock-Agentcore	All 197 actions (see the Bedrock-Agentcore page)	38 List, 8 Permissions management, 45 Read, 2 Tagging, 104 Write; 0 restricted, 0 conditional	NotAction:0
Bedrock Mantle	All 38 actions (see the Bedrock Mantle page)	8 List, 10 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
Bedrock Web Search	All 3 actions (see the Bedrock Web Search page)	3 Read; 0 restricted, 0 conditional	NotAction:0
Billing	All 47 actions (see the Billing page)	6 List, 3 Permissions management, 21 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Billing Conductor	All 34 actions (see the Billing Conductor page)	4 List, 9 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
Braket	All 20 actions (see the Braket page)	3 List, 7 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Budget	All 13 actions (see the Budget page)	6 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
BugBust	All 17 actions (see the BugBust page)	1 List, 8 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Connect Cases	All 43 actions (see the Connect Cases page)	7 List, 12 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Keyspaces	All 19 actions (see the Keyspaces page)	1 List, 3 Read, 4 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Cost Explorer Service	All 59 actions (see the Cost Explorer Service page)	6 List, 29 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Chatbot	All 39 actions (see the Chatbot page)	1 List, 15 Read, 2 Tagging, 21 Write; 0 restricted, 0 conditional	NotAction:0
Chime	All 316 actions (see the Chime page)	50 List, 70 Read, 6 Tagging, 190 Write; 0 restricted, 0 conditional	NotAction:0
Clean Rooms	All 107 actions (see the Clean Rooms page)	24 List, 29 Read, 2 Tagging, 52 Write; 0 restricted, 0 conditional	NotAction:0
Clean Rooms ML	All 59 actions (see the Clean Rooms ML page)	17 List, 1 Permissions management, 14 Read, 2 Tagging, 25 Write; 0 restricted, 0 conditional	NotAction:0
Cloud9	All 29 actions (see the Cloud9 page)	14 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Cloud Directory	All 66 actions (see the Cloud Directory page)	5 List, 25 Read, 2 Tagging, 34 Write; 0 restricted, 0 conditional	NotAction:0
CloudFormation	All 104 actions (see the CloudFormation page)	23 List, 1 Permissions management, 34 Read, 2 Tagging, 44 Write; 0 restricted, 0 conditional	NotAction:0
CloudFront	All 173 actions (see the CloudFront page)	41 List, 1 Permissions management, 45 Read, 2 Tagging, 84 Write; 0 restricted, 0 conditional	NotAction:0
CloudHSM	All 18 actions (see the CloudHSM page)	2 Permissions management, 4 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
CloudSearch	All 32 actions (see the CloudSearch page)	2 List, 1 Permissions management, 11 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
CloudShell	All 11 actions (see the CloudShell page)	1 List, 2 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
CloudTrail	All 66 actions (see the CloudTrail page)	8 List, 21 Read, 2 Tagging, 35 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch	All 160 actions (see the CloudWatch page)	24 List, 8 Permissions management, 46 Read, 2 Tagging, 80 Write; 0 restricted, 0 conditional	NotAction:0
CodeArtifact	All 51 actions (see the CodeArtifact page)	12 List, 2 Permissions management, 13 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
CodeBuild	All 67 actions (see the CodeBuild page)	18 List, 2 Permissions management, 12 Read, 35 Write; 0 restricted, 0 conditional	NotAction:0
CodeCatalyst	All 30 actions (see the CodeCatalyst page)	5 List, 5 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
CodeCommit	All 91 actions (see the CodeCommit page)	8 List, 35 Read, 2 Tagging, 46 Write; 0 restricted, 0 conditional	NotAction:0
CodeConnections	All 38 actions (see the CodeConnections page)	7 List, 16 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
CodeDeploy	All 48 actions (see the CodeDeploy page)	17 List, 8 Read, 4 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
CodeDeploy Commands Secure	All 4 actions (see the CodeDeploy Commands Secure page)	2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
CodeGuru	All 1 actions (see the CodeGuru page)	1 Read; 0 restricted, 0 conditional	NotAction:0
CodeGuru Profiler	All 21 actions (see the CodeGuru Profiler page)	5 List, 2 Permissions management, 6 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
CodeGuru Reviewer	All 17 actions (see the CodeGuru Reviewer page)	5 List, 6 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
CodeGuru Security	All 15 actions (see the CodeGuru Security page)	4 List, 5 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
CodePipeline	All 44 actions (see the CodePipeline page)	3 List, 12 Read, 2 Tagging, 27 Write; 0 restricted, 0 conditional	NotAction:0
CodeStar Connections	All 38 actions (see the CodeStar Connections page)	7 List, 16 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
CodeStar Notifications	All 13 actions (see the CodeStar Notifications page)	4 List, 1 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
CodeWhisperer	All 19 actions (see the CodeWhisperer page)	5 List, 1 Permissions management, 3 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Cognito Identity	All 21 actions (see the Cognito Identity page)	2 List, 9 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Cognito User Pools	All 139 actions (see the Cognito User Pools page)	18 List, 29 Read, 2 Tagging, 90 Write; 0 restricted, 0 conditional	NotAction:0
Cognito Sync	All 19 actions (see the Cognito Sync page)	1 List, 9 Read, 9 Write; 0 restricted, 0 conditional	NotAction:0
Comprehend	All 85 actions (see the Comprehend page)	50 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
ComprehendMedical	All 25 actions (see the ComprehendMedical page)	15 Read, 10 Write; 0 restricted, 0 conditional	NotAction:0
Compute Optimizer	All 28 actions (see the Compute Optimizer page)	15 List, 2 Read, 11 Write; 0 restricted, 0 conditional	NotAction:0
Config	All 102 actions (see the Config page)	18 List, 40 Read, 2 Tagging, 42 Write; 0 restricted, 0 conditional	NotAction:0
Connect	All 388 actions (see the Connect page)	71 List, 81 Read, 2 Tagging, 234 Write; 0 restricted, 0 conditional	NotAction:0
Connect Outbound Campaigns	All 40 actions (see the Connect Outbound Campaigns page)	2 List, 7 Read, 2 Tagging, 29 Write; 0 restricted, 0 conditional	NotAction:0
Console Mobile App	All 2 actions (see the Console Mobile App page)	1 List, 1 Read; 0 restricted, 0 conditional	NotAction:0
Consolidated Billing	All 2 actions (see the Consolidated Billing page)	1 List, 1 Read; 0 restricted, 0 conditional	NotAction:0
Continuum	All 33 actions (see the Continuum page)	9 List, 9 Read, 15 Write; 0 restricted, 0 conditional	NotAction:0
Control Catalog	All 6 actions (see the Control Catalog page)	5 List, 1 Read; 0 restricted, 0 conditional	NotAction:0
Control Tower	All 65 actions (see the Control Tower page)	17 List, 26 Read, 2 Tagging, 20 Write; 0 restricted, 0 conditional	NotAction:0
Cost Optimization Hub	All 8 actions (see the Cost Optimization Hub page)	4 List, 2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Cost and Usage Report	All 12 actions (see the Cost and Usage Report page)	6 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Customer Verification Service	All 7 actions (see the Customer Verification Service page)	3 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
DataBrew	All 44 actions (see the DataBrew page)	16 Read, 2 Tagging, 26 Write; 0 restricted, 0 conditional	NotAction:0
Data Exchange	All 39 actions (see the Data Exchange page)	8 List, 7 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Data Pipeline	All 21 actions (see the Data Pipeline page)	2 List, 6 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
DataSync	All 66 actions (see the DataSync page)	8 List, 17 Read, 2 Tagging, 39 Write; 0 restricted, 0 conditional	NotAction:0
DataZone	All 278 actions (see the DataZone page)	55 List, 6 Permissions management, 62 Read, 2 Tagging, 153 Write; 0 restricted, 0 conditional	NotAction:0
DynamoDBAccelerator	All 30 actions (see the DynamoDBAccelerator page)	5 List, 7 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
DBQMS	All 13 actions (see the DBQMS page)	3 List, 1 Read, 9 Write; 0 restricted, 0 conditional	NotAction:0
Deadline Cloud	All 92 actions (see the Deadline Cloud page)	20 List, 8 Permissions management, 18 Read, 2 Tagging, 44 Write; 0 restricted, 0 conditional	NotAction:0
Detective	All 36 actions (see the Detective page)	9 List, 11 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Device Farm	All 77 actions (see the Device Farm page)	24 List, 18 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
DevOps Guru	All 31 actions (see the DevOps Guru page)	10 List, 14 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Direct Connect	All 73 actions (see the Direct Connect page)	4 List, 19 Read, 2 Tagging, 48 Write; 0 restricted, 0 conditional	NotAction:0
Application Discovery	All 29 actions (see the Application Discovery page)	3 List, 9 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Data Lifecycle Manager	All 8 actions (see the Data Lifecycle Manager page)	1 List, 2 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
DMS	All 125 actions (see the DMS page)	51 Read, 2 Tagging, 72 Write; 0 restricted, 0 conditional	NotAction:0
DocumentDB Elastic Clusters	All 19 actions (see the DocumentDB Elastic Clusters page)	4 List, 3 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
DRS	All 110 actions (see the DRS page)	35 Read, 2 Tagging, 73 Write; 0 restricted, 0 conditional	NotAction:0
Directory Service	All 91 actions (see the Directory Service page)	4 List, 1 Permissions management, 25 Read, 2 Tagging, 59 Write; 0 restricted, 0 conditional	NotAction:0
Directory Service Data	All 17 actions (see the Directory Service Data page)	4 List, 4 Read, 9 Write; 0 restricted, 0 conditional	NotAction:0
Aurora DSQL	All 30 actions (see the Aurora DSQL page)	2 List, 7 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
DynamoDB	All 68 actions (see the DynamoDB page)	7 List, 3 Permissions management, 22 Read, 2 Tagging, 34 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Block Store	All 2 actions (see the Elastic Block Store page)	2 Write; 0 restricted, 0 conditional	NotAction:0
EC2	All 834 actions (see the EC2 page)	225 List, 23 Permissions management, 63 Read, 2 Tagging, 521 Write; 0 restricted, 0 conditional	NotAction:0
EC2 Instance Connect	All 3 actions (see the EC2 Instance Connect page)	3 Write; 0 restricted, 0 conditional	NotAction:0
EC2 Messages	All 6 actions (see the EC2 Messages page)	2 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Container Registry	All 65 actions (see the Elastic Container Registry page)	5 List, 4 Permissions management, 22 Read, 2 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Container Registry Public	All 23 actions (see the Elastic Container Registry Public page)	3 List, 1 Permissions management, 7 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Container Service	All 92 actions (see the Elastic Container Service page)	15 List, 1 Permissions management, 20 Read, 2 Tagging, 54 Write; 0 restricted, 0 conditional	NotAction:0
ECS MCP	All 2 actions (see the ECS MCP page)	2 Read; 0 restricted, 0 conditional	NotAction:0
EKS	All 74 actions (see the EKS page)	14 List, 20 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
EKS Auth	All 1 actions (see the EKS Auth page)	1 Read; 0 restricted, 0 conditional	NotAction:0
EKS MCP	All 3 actions (see the EKS MCP page)	2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
ElastiCache	All 77 actions (see the ElastiCache page)	20 List, 1 Read, 2 Tagging, 54 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Beanstalk	All 50 actions (see the Elastic Beanstalk page)	6 List, 15 Read, 3 Tagging, 26 Write; 0 restricted, 0 conditional	NotAction:0
EFS	All 38 actions (see the EFS page)	4 List, 2 Permissions management, 9 Read, 4 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
ELB	All 77 actions (see the ELB page)	2 List, 1 Permissions management, 22 Read, 2 Tagging, 50 Write; 0 restricted, 0 conditional	NotAction:0
EMR	All 88 actions (see the EMR page)	12 List, 3 Permissions management, 20 Read, 2 Tagging, 51 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Transcoder	All 17 actions (see the Elastic Transcoder page)	4 List, 3 Read, 10 Write; 0 restricted, 0 conditional	NotAction:0
Elemental Activations	All 13 actions (see the Elemental Activations page)	7 Read, 6 Write; 0 restricted, 0 conditional	NotAction:0
Elemental Appliances and Software	All 14 actions (see the Elemental Appliances and Software page)	1 List, 7 Read, 6 Write; 0 restricted, 0 conditional	NotAction:0
Elemental Inference	All 24 actions (see the Elemental Inference page)	2 List, 7 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Elemental Support Cases	All 17 actions (see the Elemental Support Cases page)	5 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Elemental Support Content	All 1 actions (see the Elemental Support Content page)	1 Read; 0 restricted, 0 conditional	NotAction:0
EMR Containers	All 25 actions (see the EMR Containers page)	6 List, 5 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
EMR Serverless	All 25 actions (see the EMR Serverless page)	4 List, 7 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
End User Messaging	All 27 actions (see the End User Messaging page)	5 List, 5 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Entity Resolution	All 40 actions (see the Entity Resolution page)	7 List, 5 Permissions management, 10 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
OpenSearch Service	All 138 actions (see the OpenSearch Service page)	34 List, 29 Read, 2 Tagging, 73 Write; 0 restricted, 0 conditional	NotAction:0
EventBridge	All 71 actions (see the EventBridge page)	15 List, 4 Permissions management, 12 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
eventsbilltoaws	All 2 actions (see the eventsbilltoaws page)	1 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
EVS	All 24 actions (see the EVS page)	5 List, 5 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
ExecuteAPI	All 3 actions (see the ExecuteAPI page)	3 Write; 0 restricted, 0 conditional	NotAction:0
FinOps Agent	All 46 actions (see the FinOps Agent page)	10 List, 11 Read, 25 Write; 0 restricted, 0 conditional	NotAction:0
FinSpace	All 59 actions (see the FinSpace page)	12 List, 12 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
FinSpace API	All 1 actions (see the FinSpace API page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Firehose	All 10 actions (see the Firehose page)	2 List, 1 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
FIS	All 29 actions (see the FIS page)	7 List, 8 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Firewall Manager	All 42 actions (see the Firewall Manager page)	11 List, 12 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
Forecast	All 70 actions (see the Forecast page)	35 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
Fraud Detector	All 74 actions (see the Fraud Detector page)	14 List, 12 Read, 2 Tagging, 46 Write; 0 restricted, 0 conditional	NotAction:0
FreeRTOS	All 20 actions (see the FreeRTOS page)	7 List, 7 Read, 6 Write; 0 restricted, 0 conditional	NotAction:0
Free Tier	All 7 actions (see the Free Tier page)	1 List, 4 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
FSx	All 56 actions (see the FSx page)	5 Permissions management, 13 Read, 2 Tagging, 36 Write; 0 restricted, 0 conditional	NotAction:0
GameLift Servers	All 121 actions (see the GameLift Servers page)	12 List, 1 Permissions management, 43 Read, 2 Tagging, 63 Write; 0 restricted, 0 conditional	NotAction:0
GameLift Streams	All 18 actions (see the GameLift Streams page)	3 List, 3 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Location	All 64 actions (see the Location page)	7 List, 27 Read, 2 Tagging, 28 Write; 0 restricted, 0 conditional	NotAction:0
Glacier	All 33 actions (see the Glacier page)	6 List, 6 Permissions management, 7 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
GlobalAccelerator	All 56 actions (see the GlobalAccelerator page)	12 List, 10 Read, 2 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
Glue	All 306 actions (see the Glue page)	27 List, 36 Permissions management, 93 Read, 2 Tagging, 148 Write; 0 restricted, 0 conditional	NotAction:0
Managed Grafana	All 25 actions (see the Managed Grafana page)	2 List, 1 Permissions management, 7 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
IoT Greengrass	All 112 actions (see the IoT Greengrass page)	26 List, 1 Permissions management, 32 Read, 2 Tagging, 51 Write; 0 restricted, 0 conditional	NotAction:0
Ground Station	All 40 actions (see the Ground Station page)	10 List, 11 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
GroundTruth Labeling	All 16 actions (see the GroundTruth Labeling page)	6 Read, 10 Write; 0 restricted, 0 conditional	NotAction:0
GuardDuty	All 103 actions (see the GuardDuty page)	18 List, 29 Read, 2 Tagging, 54 Write; 0 restricted, 0 conditional	NotAction:0
Health	All 14 actions (see the Health page)	2 Permissions management, 12 Read; 0 restricted, 0 conditional	NotAction:0
Connect Health	All 45 actions (see the Connect Health page)	6 List, 16 Read, 2 Tagging, 21 Write; 0 restricted, 0 conditional	NotAction:0
HealthLake	All 68 actions (see the HealthLake page)	7 List, 27 Read, 2 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
Honeycode	All 30 actions (see the Honeycode page)	7 List, 4 Read, 3 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
IAM	189 of 190	40 List, 22 Permissions management, 37 Read, 16 Tagging, 74 Write; 3 restricted, 3 conditional	NotAction:0, iam:CreateRole, iam:CreateUser, iam:PutRolePermissionsBoundary
Identity Sync	All 13 actions (see the Identity Sync page)	1 List, 1 Permissions management, 2 Read, 9 Write; 0 restricted, 0 conditional	NotAction:0
Identity Store	All 29 actions (see the Identity Store page)	6 List, 9 Read, 14 Write; 0 restricted, 0 conditional	NotAction:0
Identity Store Auth	All 3 actions (see the Identity Store Auth page)	1 List, 1 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
EC2 Image Builder	All 77 actions (see the EC2 Image Builder page)	21 List, 4 Permissions management, 18 Read, 2 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
Import/Export	All 6 actions (see the Import/Export page)	1 List, 2 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
Inspector	All 37 actions (see the Inspector page)	8 List, 13 Read, 1 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
InspectorScan	All 1 actions (see the InspectorScan page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Inspector2	All 84 actions (see the Inspector2 page)	20 List, 21 Read, 2 Tagging, 41 Write; 0 restricted, 0 conditional	NotAction:0
Inspector2Telemtry	All 5 actions (see the Inspector2Telemtry page)	5 Write; 0 restricted, 0 conditional	NotAction:0
Interconnect	All 13 actions (see the Interconnect page)	2 List, 5 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Internet Monitor	All 17 actions (see the Internet Monitor page)	3 List, 8 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Invoicing Service	All 26 actions (see the Invoicing Service page)	5 List, 8 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
IoT	All 293 actions (see the IoT page)	68 List, 10 Permissions management, 64 Read, 2 Tagging, 149 Write; 0 restricted, 0 conditional	NotAction:0
IoT Device Tester	All 5 actions (see the IoT Device Tester page)	4 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
IoT Analytics	All 34 actions (see the IoT Analytics page)	5 List, 9 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
IoT Device Advisor	All 14 actions (see the IoT Device Advisor page)	2 List, 5 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
IoT Fleet Hub	All 8 actions (see the IoT Fleet Hub page)	1 List, 2 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
IoT FleetWise	All 56 actions (see the IoT FleetWise page)	3 List, 1 Permissions management, 22 Read, 2 Tagging, 28 Write; 0 restricted, 0 conditional	NotAction:0
IoT Jobs DataPlane	All 4 actions (see the IoT Jobs DataPlane page)	2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
IoT Managed Integrations	All 83 actions (see the IoT Managed Integrations page)	11 List, 29 Read, 2 Tagging, 41 Write; 0 restricted, 0 conditional	NotAction:0
IoT SiteWise	All 129 actions (see the IoT SiteWise page)	32 List, 31 Read, 2 Tagging, 64 Write; 0 restricted, 0 conditional	NotAction:0
IoT TwinMaker	All 37 actions (see the IoT TwinMaker page)	10 List, 8 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
IoT Wireless	All 113 actions (see the IoT Wireless page)	45 Read, 2 Tagging, 66 Write; 0 restricted, 0 conditional	NotAction:0
IQ	All 63 actions (see the IQ page)	1 List, 23 Read, 39 Write; 0 restricted, 0 conditional	NotAction:0
IQ Permission	All 9 actions (see the IQ Permission page)	2 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Interactive Video Service	All 83 actions (see the Interactive Video Service page)	19 List, 20 Read, 2 Tagging, 42 Write; 0 restricted, 0 conditional	NotAction:0
Interactive Video Service Chat	All 17 actions (see the Interactive Video Service Chat page)	2 List, 3 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
MSK	All 64 actions (see the MSK page)	15 List, 14 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
Apache Kafka APIs for MSK	All 19 actions (see the Apache Kafka APIs for MSK page)	6 List, 1 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
MSK Connect	All 21 actions (see the MSK Connect page)	9 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Kendra	All 66 actions (see the Kendra page)	12 List, 16 Read, 2 Tagging, 36 Write; 0 restricted, 0 conditional	NotAction:0
Kendra Intelligent Ranking	All 8 actions (see the Kendra Intelligent Ranking page)	1 List, 2 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
Kinesis	All 42 actions (see the Kinesis page)	4 List, 9 Read, 5 Tagging, 24 Write; 0 restricted, 0 conditional	NotAction:0
Kinesis Analytics	All 34 actions (see the Kinesis Analytics page)	1 List, 11 Read, 2 Tagging, 20 Write; 0 restricted, 0 conditional	NotAction:0
Kinesis Video Streams	All 37 actions (see the Kinesis Video Streams page)	6 List, 10 Read, 4 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
KMS	All 58 actions (see the KMS page)	7 List, 4 Permissions management, 7 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
Lake Formation	All 68 actions (see the Lake Formation page)	8 List, 7 Permissions management, 21 Read, 2 Tagging, 30 Write; 0 restricted, 0 conditional	NotAction:0
Lambda	All 121 actions (see the Lambda page)	25 List, 8 Permissions management, 31 Read, 2 Tagging, 55 Write; 0 restricted, 0 conditional	NotAction:0
Launch Wizard	All 40 actions (see the Launch Wizard page)	11 List, 16 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Lex	All 146 actions (see the Lex page)	39 List, 37 Read, 2 Tagging, 68 Write; 0 restricted, 0 conditional	NotAction:0
License Manager	All 62 actions (see the License Manager page)	20 List, 1 Permissions management, 11 Read, 2 Tagging, 28 Write; 0 restricted, 0 conditional	NotAction:0
License Manager Linux Subscriptions	All 11 actions (see the License Manager Linux Subscriptions page)	6 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
License Manager User Subscriptions	All 17 actions (see the License Manager User Subscriptions page)	5 List, 1 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
Lightsail	All 161 actions (see the Lightsail page)	64 Read, 2 Tagging, 95 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch Logs	All 133 actions (see the CloudWatch Logs page)	33 List, 2 Permissions management, 26 Read, 4 Tagging, 68 Write; 0 restricted, 0 conditional	NotAction:0
Lookout for Equipment	All 49 actions (see the Lookout for Equipment page)	9 List, 12 Read, 2 Tagging, 26 Write; 0 restricted, 0 conditional	NotAction:0
Lookout Metrics	All 30 actions (see the Lookout Metrics page)	6 List, 9 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Lookout Vision	All 25 actions (see the Lookout Vision page)	4 List, 7 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Mainframe Modernization	All 37 actions (see the Mainframe Modernization page)	2 List, 19 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Machine Learning	All 27 actions (see the Machine Learning page)	5 List, 4 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
Macie	All 81 actions (see the Macie page)	14 List, 28 Read, 2 Tagging, 37 Write; 0 restricted, 0 conditional	NotAction:0
Managed Blockchain	All 34 actions (see the Managed Blockchain page)	6 List, 3 Permissions management, 11 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
MapCredits	All 3 actions (see the MapCredits page)	3 List; 0 restricted, 0 conditional	NotAction:0
CAS	All 2 actions (see the CAS page)	2 Write; 0 restricted, 0 conditional	NotAction:0
MechanicalTurk	All 39 actions (see the MechanicalTurk page)	10 List, 6 Read, 23 Write; 0 restricted, 0 conditional	NotAction:0
MediaConnect	All 95 actions (see the MediaConnect page)	12 List, 5 Permissions management, 18 Read, 2 Tagging, 58 Write; 0 restricted, 0 conditional	NotAction:0
MediaConvert	All 32 actions (see the MediaConvert page)	7 List, 7 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
mediaimport	All 1 actions (see the mediaimport page)	1 Write; 0 restricted, 0 conditional	NotAction:0
MediaLive	All 125 actions (see the MediaLive page)	24 List, 22 Read, 2 Tagging, 77 Write; 0 restricted, 0 conditional	NotAction:0
MediaPackage	All 19 actions (see the MediaPackage page)	7 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
MediaPackage VOD	All 17 actions (see the MediaPackage VOD page)	3 List, 4 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
MediaPackage v2	All 34 actions (see the MediaPackage v2 page)	4 List, 10 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
MediaStore	All 26 actions (see the MediaStore page)	4 List, 2 Permissions management, 6 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
MediaTailor	All 44 actions (see the MediaTailor page)	2 List, 2 Permissions management, 15 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
HealthImaging	All 27 actions (see the HealthImaging page)	4 List, 13 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
MemoryDB	All 47 actions (see the MemoryDB page)	18 Read, 2 Tagging, 27 Write; 0 restricted, 0 conditional	NotAction:0
Migration Hub	All 46 actions (see the Migration Hub page)	13 List, 6 Read, 2 Tagging, 25 Write; 0 restricted, 0 conditional	NotAction:0
MGN	All 147 actions (see the MGN page)	34 List, 20 Read, 2 Tagging, 91 Write; 0 restricted, 0 conditional	NotAction:0
MigrationHubOrchestrator	All 34 actions (see the MigrationHubOrchestrator page)	7 List, 8 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
Migration Hub Strategy Recommendations	All 31 actions (see the Migration Hub Strategy Recommendations page)	7 List, 12 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
Mobile Analytics	All 3 actions (see the Mobile Analytics page)	2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
Pinpoint	All 119 actions (see the Pinpoint page)	16 List, 39 Read, 2 Tagging, 62 Write; 0 restricted, 0 conditional	NotAction:0
Monitron	All 18 actions (see the Monitron page)	3 List, 7 Permissions management, 3 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
Multi-party approval	All 25 actions (see the Multi-party approval page)	7 List, 2 Permissions management, 5 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
MQ	All 27 actions (see the MQ page)	5 List, 7 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Neptune	All 33 actions (see the Neptune page)	5 List, 11 Read, 17 Write; 0 restricted, 0 conditional	NotAction:0
Neptune Analytics	All 38 actions (see the Neptune Analytics page)	17 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
Network Firewall	All 89 actions (see the Network Firewall page)	13 List, 19 Read, 2 Tagging, 55 Write; 0 restricted, 0 conditional	NotAction:0
Network Security Director	All 8 actions (see the Network Security Director page)	5 List, 2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
Network Security Manager	All 46 actions (see the Network Security Manager page)	6 List, 15 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
Network Flow Monitor	All 14 actions (see the Network Flow Monitor page)	2 List, 3 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
Network Manager	All 97 actions (see the Network Manager page)	19 List, 3 Permissions management, 20 Read, 2 Tagging, 53 Write; 0 restricted, 0 conditional	NotAction:0
Network Manager Chat	All 7 actions (see the Network Manager Chat page)	2 List, 5 Write; 0 restricted, 0 conditional	NotAction:0
Network Synthetic Monitor	All 12 actions (see the Network Synthetic Monitor page)	1 List, 3 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Nimble Studio	All 51 actions (see the Nimble Studio page)	24 Read, 2 Tagging, 25 Write; 0 restricted, 0 conditional	NotAction:0
User Notifications	All 44 actions (see the User Notifications page)	12 List, 2 Permissions management, 9 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
User Notifications Contacts	All 9 actions (see the User Notifications Contacts page)	1 List, 2 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Nova Act	All 12 actions (see the Nova Act page)	2 List, 5 Read, 5 Write; 0 restricted, 0 conditional	NotAction:0
OAM	All 15 actions (see the OAM page)	7 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch Observability Admin	All 45 actions (see the CloudWatch Observability Admin page)	7 List, 13 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
Oracle Database@AWS	All 96 actions (see the Oracle Database@AWS page)	21 List, 16 Read, 2 Tagging, 57 Write; 0 restricted, 0 conditional	NotAction:0
Omics	All 108 actions (see the Omics page)	26 List, 2 Permissions management, 25 Read, 2 Tagging, 53 Write; 0 restricted, 0 conditional	NotAction:0
One	All 28 actions (see the One page)	5 List, 6 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
OpenSearch	All 11 actions (see the OpenSearch page)	1 List, 2 Permissions management, 3 Read, 5 Write; 0 restricted, 0 conditional	NotAction:0
OpsWorks	All 74 actions (see the OpsWorks page)	23 List, 2 Permissions management, 1 Read, 2 Tagging, 46 Write; 0 restricted, 0 conditional	NotAction:0
OpsworksCM	All 19 actions (see the OpsworksCM page)	5 List, 2 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Organizations	All 63 actions (see the Organizations page)	20 List, 5 Permissions management, 9 Read, 2 Tagging, 27 Write; 0 restricted, 0 conditional	NotAction:0
OpenSearch Ingestion	All 23 actions (see the OpenSearch Ingestion page)	4 List, 6 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Outposts	All 44 actions (see the Outposts page)	10 List, 14 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
Panorama	All 36 actions (see the Panorama page)	9 List, 12 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Partner Central	All 164 actions (see the Partner Central page)	36 List, 45 Read, 2 Tagging, 81 Write; 0 restricted, 0 conditional	NotAction:0
Partner central account management	All 6 actions (see the Partner central account management page)	6 Write; 0 restricted, 0 conditional	NotAction:0
Payment Cryptography	All 47 actions (see the Payment Cryptography page)	2 List, 2 Permissions management, 10 Read, 2 Tagging, 31 Write; 0 restricted, 0 conditional	NotAction:0
Payments	All 28 actions (see the Payments page)	10 List, 6 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Private CA Connector for Active Directory	All 25 actions (see the Private CA Connector for Active Directory page)	5 List, 6 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Private CA Connector for SCEP	All 12 actions (see the Private CA Connector for SCEP page)	2 List, 4 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Parallel Computing Service	All 20 actions (see the Parallel Computing Service page)	3 List, 4 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Personalize	All 83 actions (see the Personalize page)	19 List, 24 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
Performance Insights	All 14 actions (see the Performance Insights page)	3 List, 7 Read, 2 Tagging, 2 Write; 0 restricted, 0 conditional	NotAction:0
EventBridge Pipes	All 10 actions (see the EventBridge Pipes page)	1 List, 2 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
Polly	All 13 actions (see the Polly page)	3 List, 5 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
Price List	All 5 actions (see the Price List page)	5 Read; 0 restricted, 0 conditional	NotAction:0
PricingPlanManager	All 9 actions (see the PricingPlanManager page)	2 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Private 5G	All 26 actions (see the Private 5G page)	6 List, 6 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Profile	All 117 actions (see the Profile page)	28 List, 36 Read, 2 Tagging, 51 Write; 0 restricted, 0 conditional	NotAction:0
Proton	All 111 actions (see the Proton page)	24 List, 26 Read, 2 Tagging, 59 Write; 0 restricted, 0 conditional	NotAction:0
Purchase Orders	All 14 actions (see the Purchase Orders page)	2 List, 4 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Q	All 54 actions (see the Q page)	8 List, 14 Read, 2 Tagging, 30 Write; 0 restricted, 0 conditional	NotAction:0
Q Apps	All 21 actions (see the Q Apps page)	2 List, 3 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Q Business	All 67 actions (see the Q Business page)	11 List, 1 Permissions management, 14 Read, 2 Tagging, 39 Write; 0 restricted, 0 conditional	NotAction:0
Q Developer	All 7 actions (see the Q Developer page)	1 List, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
QLDB	All 35 actions (see the QLDB page)	4 List, 9 Read, 2 Tagging, 20 Write; 0 restricted, 0 conditional	NotAction:0
QuickSight	All 357 actions (see the QuickSight page)	68 List, 19 Permissions management, 91 Read, 2 Tagging, 177 Write; 0 restricted, 0 conditional	NotAction:0
Resource Access Manager	All 39 actions (see the Resource Access Manager page)	9 List, 3 Permissions management, 7 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
Recycle Bin	All 10 actions (see the Recycle Bin page)	3 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
RDS	All 173 actions (see the RDS page)	47 List, 1 Permissions management, 5 Read, 2 Tagging, 118 Write; 0 restricted, 0 conditional	NotAction:0
RDS IAM Authentication	All 1 actions (see the RDS IAM Authentication page)	1 Permissions management; 0 restricted, 0 conditional	NotAction:0
Redshift	All 167 actions (see the Redshift page)	18 List, 13 Permissions management, 40 Read, 2 Tagging, 94 Write; 0 restricted, 0 conditional	NotAction:0
Redshift Data API	All 12 actions (see the Redshift Data API page)	3 List, 6 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
Redshift Serverless	All 69 actions (see the Redshift Serverless page)	15 List, 17 Read, 2 Tagging, 35 Write; 0 restricted, 0 conditional	NotAction:0
Migration Hub Refactor Spaces	All 24 actions (see the Migration Hub Refactor Spaces page)	11 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Rekognition	All 76 actions (see the Rekognition page)	1 List, 36 Read, 2 Tagging, 37 Write; 0 restricted, 0 conditional	NotAction:0
re:Post Private	All 19 actions (see the re:Post Private page)	5 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Bio Discovery	All 6 actions (see the Bio Discovery page)	1 List, 1 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
Resilience Hub	All 133 actions (see the Resilience Hub page)	20 List, 46 Read, 2 Tagging, 65 Write; 0 restricted, 0 conditional	NotAction:0
Tag Editor	All 3 actions (see the Tag Editor page)	2 List, 1 Read; 0 restricted, 0 conditional	NotAction:0
Resource Explorer	All 37 actions (see the Resource Explorer page)	8 List, 2 Permissions management, 12 Read, 2 Tagging, 13 Write; 0 restricted, 0 conditional	NotAction:0
Resource Groups	All 29 actions (see the Resource Groups page)	6 List, 7 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
RHEL KB	All 1 actions (see the RHEL KB page)	1 Read; 0 restricted, 0 conditional	NotAction:0
RoboMaker	All 59 actions (see the RoboMaker page)	13 List, 13 Read, 2 Tagging, 31 Write; 0 restricted, 0 conditional	NotAction:0
IAM Roles Anywhere	All 30 actions (see the IAM Roles Anywhere page)	5 List, 4 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
Route 53	All 71 actions (see the Route 53 page)	22 List, 16 Read, 1 Tagging, 32 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Recovery Cluster	All 4 actions (see the Route 53 Recovery Cluster page)	2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Recovery Controls	All 27 actions (see the Route 53 Recovery Controls page)	1 List, 2 Permissions management, 10 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Recovery Readiness	All 32 actions (see the Route 53 Recovery Readiness page)	16 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Domains	All 36 actions (see the Route 53 Domains page)	3 List, 9 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Global Resolver	All 48 actions (see the Route 53 Global Resolver page)	8 List, 1 Permissions management, 9 Read, 2 Tagging, 28 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Profiles	All 19 actions (see the Route 53 Profiles page)	4 List, 4 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
Route 53 Resolver	All 70 actions (see the Route 53 Resolver page)	16 List, 3 Permissions management, 16 Read, 2 Tagging, 33 Write; 0 restricted, 0 conditional	NotAction:0
RTB Fabric	All 36 actions (see the RTB Fabric page)	5 List, 8 Read, 2 Tagging, 21 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch RUM	All 19 actions (see the CloudWatch RUM page)	1 List, 6 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
S3	All 155 actions (see the S3 page)	15 List, 24 Permissions management, 58 Read, 8 Tagging, 50 Write; 0 restricted, 0 conditional	NotAction:0
S3 Object Lambda	All 26 actions (see the S3 Object Lambda page)	4 List, 2 Permissions management, 8 Read, 4 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
S3 Outposts	All 48 actions (see the S3 Outposts page)	9 List, 5 Permissions management, 13 Read, 6 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
S3 Express	All 28 actions (see the S3 Express page)	3 List, 6 Permissions management, 8 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
S3 Files	All 24 actions (see the S3 Files page)	3 List, 2 Permissions management, 7 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
S3 Tables	All 61 actions (see the S3 Tables page)	5 List, 4 Permissions management, 22 Read, 2 Tagging, 28 Write; 0 restricted, 0 conditional	NotAction:0
S3 Vectors	All 21 actions (see the S3 Vectors page)	4 List, 2 Permissions management, 5 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
SageMaker	All 441 actions (see the SageMaker page)	96 List, 97 Read, 2 Tagging, 246 Write; 0 restricted, 0 conditional	NotAction:0
SageMakerDataScienceAssistant	All 1 actions (see the SageMakerDataScienceAssistant page)	1 Write; 0 restricted, 0 conditional	NotAction:0
SageMaker geospatial capabilities	All 19 actions (see the SageMaker geospatial capabilities page)	4 List, 5 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
SageMaker MLflow	All 61 actions (see the SageMaker MLflow page)	3 List, 17 Read, 41 Write; 0 restricted, 0 conditional	NotAction:0
SageMaker Unified Studio MCP	All 1 actions (see the SageMaker Unified Studio MCP page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Savings Plans	All 10 actions (see the Savings Plans page)	1 List, 4 Read, 2 Tagging, 3 Write; 0 restricted, 0 conditional	NotAction:0
EventBridge Scheduler	All 13 actions (see the EventBridge Scheduler page)	3 List, 3 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
EventBridge Schemas	All 31 actions (see the EventBridge Schemas page)	5 List, 9 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
ASC	All 31 actions (see the ASC page)	6 List, 6 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
SimpleDB	All 13 actions (see the SimpleDB page)	2 List, 4 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Secrets Manager	All 27 actions (see the Secrets Manager page)	1 List, 3 Permissions management, 7 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Security Incident Response	All 25 actions (see the Security Incident Response page)	2 List, 9 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
securityagent	All 119 actions (see the securityagent page)	27 List, 28 Read, 2 Tagging, 62 Write; 0 restricted, 0 conditional	NotAction:0
SecurityHub	All 141 actions (see the SecurityHub page)	20 List, 1 Permissions management, 52 Read, 2 Tagging, 66 Write; 0 restricted, 0 conditional	NotAction:0
SecurityLake	All 31 actions (see the SecurityLake page)	5 List, 4 Read, 2 Tagging, 20 Write; 0 restricted, 0 conditional	NotAction:0
Serverless Application Repository	All 15 actions (see the Serverless Application Repository page)	3 List, 4 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
Service Catalog	All 117 actions (see the Service Catalog page)	28 List, 3 Permissions management, 23 Read, 2 Tagging, 61 Write; 0 restricted, 0 conditional	NotAction:0
Cloud Map	All 31 actions (see the Cloud Map page)	1 List, 11 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
Microservice Extractor for .NET	All 1 actions (see the Microservice Extractor for .NET page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Service Quotas	All 26 actions (see the Service Quotas page)	15 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
SES	All 231 actions (see the SES page)	31 List, 8 Permissions management, 61 Read, 2 Tagging, 129 Write; 0 restricted, 0 conditional	NotAction:0
Shield	All 40 actions (see the Shield page)	5 List, 11 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	NotAction:0
Signer	All 18 actions (see the Signer page)	3 List, 2 Permissions management, 5 Read, 2 Tagging, 6 Write; 0 restricted, 0 conditional	NotAction:0
Signin	All 17 actions (see the Signin page)	2 List, 7 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
SimSpace Weaver	All 16 actions (see the SimSpace Weaver page)	1 List, 4 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
ServerMigrationService	All 37 actions (see the ServerMigrationService page)	1 List, 10 Read, 26 Write; 0 restricted, 0 conditional	NotAction:0
Pinpoint SMS Voice	All 107 actions (see the Pinpoint SMS Voice page)	2 Permissions management, 33 Read, 2 Tagging, 70 Write; 0 restricted, 0 conditional	NotAction:0
Snow Device Management	All 13 actions (see the Snow Device Management page)	4 List, 5 Read, 2 Tagging, 2 Write; 0 restricted, 0 conditional	NotAction:0
Snowball	All 27 actions (see the Snowball page)	7 List, 9 Read, 11 Write; 0 restricted, 0 conditional	NotAction:0
SNS	All 40 actions (see the SNS page)	7 List, 3 Permissions management, 10 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
Social Messaging	All 32 actions (see the Social Messaging page)	5 List, 8 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
SQL Workbench	All 79 actions (see the SQL Workbench page)	9 List, 23 Read, 2 Tagging, 45 Write; 0 restricted, 0 conditional	NotAction:0
SQS	All 20 actions (see the SQS page)	3 Permissions management, 7 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	NotAction:0
Systems Manager	All 164 actions (see the Systems Manager page)	35 List, 3 Permissions management, 51 Read, 2 Tagging, 73 Write; 0 restricted, 0 conditional	NotAction:0
Incident Manager Contacts	All 40 actions (see the Incident Manager Contacts page)	11 List, 1 Permissions management, 8 Read, 2 Tagging, 18 Write; 0 restricted, 0 conditional	NotAction:0
GUI Connect	All 7 actions (see the GUI Connect page)	1 List, 2 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
Incident Manager	All 31 actions (see the Incident Manager page)	6 List, 2 Permissions management, 7 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0
Systems Manager Quick Setup	All 14 actions (see the Systems Manager Quick Setup page)	2 List, 5 Read, 2 Tagging, 5 Write; 0 restricted, 0 conditional	NotAction:0
Systems Manager for SAP	All 30 actions (see the Systems Manager for SAP page)	9 List, 3 Permissions management, 6 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
SSM Messages	All 4 actions (see the SSM Messages page)	4 Write; 0 restricted, 0 conditional	NotAction:0
IAM Identity Center	All 126 actions (see the IAM Identity Center page)	23 List, 8 Permissions management, 35 Read, 2 Tagging, 58 Write; 0 restricted, 0 conditional	NotAction:0
IAM Identity Center directory	All 57 actions (see the IAM Identity Center directory page)	25 Read, 32 Write; 0 restricted, 0 conditional	NotAction:0
OIDC service	All 3 actions (see the OIDC service page)	3 Write; 0 restricted, 0 conditional	NotAction:0
Startups	All 1 actions (see the Startups page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Step Functions	All 37 actions (see the Step Functions page)	7 List, 9 Read, 2 Tagging, 19 Write; 0 restricted, 0 conditional	NotAction:0
Storage Gateway	All 97 actions (see the Storage Gateway page)	12 List, 21 Read, 2 Tagging, 62 Write; 0 restricted, 0 conditional	NotAction:0
STS	15 of 16	4 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
Support	All 39 actions (see the Support page)	22 Read, 17 Write; 0 restricted, 0 conditional	NotAction:0
Support Console	All 13 actions (see the Support Console page)	9 Read, 4 Write; 0 restricted, 0 conditional	NotAction:0
Support App	All 13 actions (see the Support App page)	5 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
Support Authorization	All 12 actions (see the Support Authorization page)	3 List, 3 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	NotAction:0
Support Plans	All 13 actions (see the Support Plans page)	3 List, 3 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Sustainability	All 5 actions (see the Sustainability page)	5 Read; 0 restricted, 0 conditional	NotAction:0
SWF	All 32 actions (see the SWF page)	4 List, 3 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch Synthetics	All 22 actions (see the CloudWatch Synthetics page)	3 List, 7 Read, 2 Tagging, 10 Write; 0 restricted, 0 conditional	NotAction:0
Resource Group Tagging	All 9 actions (see the Resource Group Tagging page)	1 List, 5 Read, 2 Tagging, 1 Write; 0 restricted, 0 conditional	NotAction:0
Tax Settings	All 23 actions (see the Tax Settings page)	12 Read, 11 Write; 0 restricted, 0 conditional	NotAction:0
Textract	All 25 actions (see the Textract page)	14 Read, 2 Tagging, 9 Write; 0 restricted, 0 conditional	NotAction:0
WorkSpaces Thin Client	All 18 actions (see the WorkSpaces Thin Client page)	5 List, 4 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
Timestream	All 32 actions (see the Timestream page)	4 List, 9 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
Timestream InfluxDB	All 24 actions (see the Timestream InfluxDB page)	4 List, 6 Read, 2 Tagging, 12 Write; 0 restricted, 0 conditional	NotAction:0
Tiros	All 5 actions (see the Tiros page)	3 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Telco Network Builder	All 33 actions (see the Telco Network Builder page)	6 List, 9 Read, 2 Tagging, 16 Write; 0 restricted, 0 conditional	NotAction:0
Transcribe	All 52 actions (see the Transcribe page)	9 List, 11 Read, 2 Tagging, 30 Write; 0 restricted, 0 conditional	NotAction:0
Transfer	All 72 actions (see the Transfer page)	5 List, 23 Read, 2 Tagging, 42 Write; 0 restricted, 0 conditional	NotAction:0
Transform	All 22 actions (see the Transform page)	2 List, 7 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Transform custom	All 58 actions (see the Transform custom page)	8 List, 2 Permissions management, 15 Read, 2 Tagging, 31 Write; 0 restricted, 0 conditional	NotAction:0
Translate	All 19 actions (see the Translate page)	4 List, 6 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
Trusted Advisor	All 42 actions (see the Trusted Advisor page)	7 List, 22 Read, 13 Write; 0 restricted, 0 conditional	NotAction:0
Diagnostic tools	All 9 actions (see the Diagnostic tools page)	2 List, 4 Read, 2 Tagging, 1 Write; 0 restricted, 0 conditional	NotAction:0
User Subscriptions	All 25 actions (see the User Subscriptions page)	7 List, 6 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
User Experience Customization (UXC)	All 4 actions (see the User Experience Customization (UXC) page)	1 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
Vendor Insights	All 24 actions (see the Vendor Insights page)	5 List, 6 Read, 2 Tagging, 11 Write; 0 restricted, 0 conditional	NotAction:0
Verified Access	All 1 actions (see the Verified Access page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Verified Permissions	All 31 actions (see the Verified Permissions page)	5 List, 9 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
Voice ID	All 31 actions (see the Voice ID page)	6 List, 8 Read, 2 Tagging, 15 Write; 0 restricted, 0 conditional	NotAction:0
VPC Lattice	All 75 actions (see the VPC Lattice page)	15 List, 5 Permissions management, 15 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
VPC Lattice Services	All 2 actions (see the VPC Lattice Services page)	2 Write; 0 restricted, 0 conditional	NotAction:0
VPC Endpoints	All 1 actions (see the VPC Endpoints page)	1 Write; 0 restricted, 0 conditional	NotAction:0
WAF	All 77 actions (see the WAF page)	15 List, 5 Permissions management, 19 Read, 2 Tagging, 36 Write; 0 restricted, 0 conditional	NotAction:0
WAF Regional	All 81 actions (see the WAF Regional page)	16 List, 5 Permissions management, 20 Read, 2 Tagging, 38 Write; 0 restricted, 0 conditional	NotAction:0
WAF V2	All 64 actions (see the WAF V2 page)	12 List, 2 Permissions management, 25 Read, 2 Tagging, 23 Write; 0 restricted, 0 conditional	NotAction:0
WAM	All 1 actions (see the WAM page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Well-Architected Tool	All 95 actions (see the Well-Architected Tool page)	18 List, 27 Read, 2 Tagging, 48 Write; 0 restricted, 0 conditional	NotAction:0
Wickr	All 48 actions (see the Wickr page)	21 Read, 2 Tagging, 25 Write; 0 restricted, 0 conditional	NotAction:0
Q in Connect	All 97 actions (see the Q in Connect page)	18 List, 1 Permissions management, 23 Read, 2 Tagging, 53 Write; 0 restricted, 0 conditional	NotAction:0
WorkDocs	All 61 actions (see the WorkDocs page)	14 List, 10 Read, 37 Write; 0 restricted, 0 conditional	NotAction:0
WorkLink	All 34 actions (see the WorkLink page)	6 List, 9 Read, 2 Tagging, 17 Write; 0 restricted, 0 conditional	NotAction:0
WorkMail	All 126 actions (see the WorkMail page)	22 List, 28 Read, 2 Tagging, 74 Write; 0 restricted, 0 conditional	NotAction:0
WorkMail Message Flow	All 2 actions (see the WorkMail Message Flow page)	1 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
WorkSpaces	All 103 actions (see the WorkSpaces page)	16 List, 3 Permissions management, 16 Read, 2 Tagging, 66 Write; 0 restricted, 0 conditional	NotAction:0
WorkSpaces Managed Instances	All 14 actions (see the WorkSpaces Managed Instances page)	4 List, 1 Read, 2 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
WorkSpaces Secure Browser	All 75 actions (see the WorkSpaces Secure Browser page)	26 Read, 2 Tagging, 47 Write; 0 restricted, 0 conditional	NotAction:0
X-Ray	All 32 actions (see the X-Ray page)	2 List, 1 Permissions management, 13 Read, 2 Tagging, 14 Write; 0 restricted, 0 conditional	NotAction:0

IAM: 189 actions

iam:AcceptDelegationRequest (Write)
iam:AddClientIDToOpenIDConnectProvider (Write)
iam:AddRoleToInstanceProfile (Write)
iam:AddUserToGroup (Write)
iam:AssociateDelegationRequest (Write)
iam:AttachGroupPolicy (Permissions management)
iam:AttachRolePolicy (Permissions management)
iam:AttachUserPolicy (Permissions management)
iam:ChangePassword (Write)
iam:CreateAccessKey (Write)
iam:CreateAccountAlias (Write)
iam:CreateDelegationRequest (Write)
iam:CreateGroup (Write)
iam:CreateInstanceProfile (Write)
iam:CreateLoginProfile (Write)
iam:CreateOpenIDConnectProvider (Write)
iam:CreatePolicy (Permissions management)
iam:CreatePolicyVersion (Permissions management)
iam:CreateRole (Write)
iam:CreateSAMLProvider (Write)
iam:CreateServiceLinkedRole (Write)
iam:CreateServiceSpecificCredential (Write)
iam:CreateUser (Write)
iam:CreateVirtualMFADevice (Write)
iam:DeactivateMFADevice (Write)
iam:DeleteAccessKey (Write)
iam:DeleteAccountAlias (Write)
iam:DeleteAccountPasswordPolicy (Permissions management)
iam:DeleteCloudFrontPublicKey (Write)
iam:DeleteGroup (Write)
iam:DeleteGroupPolicy (Permissions management)
iam:DeleteInstanceProfile (Write)
iam:DeleteLoginProfile (Write)
iam:DeleteOpenIDConnectProvider (Write)
iam:DeletePolicy (Permissions management)
iam:DeletePolicyVersion (Permissions management)
iam:DeleteRole (Write)
iam:DeleteRolePolicy (Permissions management)
iam:DeleteSAMLProvider (Write)
iam:DeleteSSHPublicKey (Write)
iam:DeleteServerCertificate (Write)
iam:DeleteServiceLinkedRole (Write)
iam:DeleteServiceSpecificCredential (Write)
iam:DeleteSigningCertificate (Write)
iam:DeleteUser (Write)
iam:DeleteUserPermissionsBoundary (Permissions management)
iam:DeleteUserPolicy (Permissions management)
iam:DeleteVirtualMFADevice (Write)
iam:DetachGroupPolicy (Permissions management)
iam:DetachRolePolicy (Permissions management)
iam:DetachUserPolicy (Permissions management)
iam:DisableOrganizationsRootCredentialsManagement (Write)
iam:DisableOrganizationsRootSessions (Write)
iam:DisableOutboundWebIdentityFederation (Write)
iam:EnableMFADevice (Write)
iam:EnableOrganizationsRootCredentialsManagement (Write)
iam:EnableOrganizationsRootSessions (Write)
iam:EnableOutboundWebIdentityFederation (Write)
iam:GenerateCredentialReport (Read)
iam:GenerateOrganizationsAccessReport (Read)
iam:GenerateServiceLastAccessedDetails (Read)
iam:GetAccessKeyLastUsed (Read)
iam:GetAccountAuthorizationDetails (Read)
iam:GetAccountEmailAddress (Read)
iam:GetAccountName (Read)
iam:GetAccountPasswordPolicy (Read)
iam:GetAccountProperties (Read)
iam:GetAccountSummary (List)
iam:GetCloudFrontPublicKey (Read)
iam:GetContextKeysForCustomPolicy (Read)
iam:GetContextKeysForPrincipalPolicy (Read)
iam:GetCredentialReport (Read)
iam:GetDelegationRequest (Read)
iam:GetGroup (Read)
iam:GetGroupPolicy (Read)
iam:GetHumanReadableSummary (Read)
iam:GetInstanceProfile (Read)
iam:GetLoginProfile (List)
iam:GetMFADevice (Read)
iam:GetOpenIDConnectProvider (Read)
iam:GetOrganizationsAccessReport (Read)
iam:GetOutboundWebIdentityFederationInfo (Read)
iam:GetPolicy (Read)
iam:GetPolicyVersion (Read)
iam:GetRole (Read)
iam:GetRolePolicy (Read)
iam:GetRoleTemplateVersion (Read)
iam:GetSAMLProvider (Read)
iam:GetSSHPublicKey (Read)
iam:GetServerCertificate (Read)
iam:GetServiceLastAccessedDetails (Read)
iam:GetServiceLastAccessedDetailsWithEntities (Read)
iam:GetServiceLinkedRoleDeletionStatus (Read)
iam:GetUser (Read)
iam:GetUserPolicy (Read)
iam:ListAccessKeys (List)
iam:ListAccountAliases (List)
iam:ListAttachedGroupPolicies (List)
iam:ListAttachedRolePolicies (List)
iam:ListAttachedUserPolicies (List)
iam:ListCloudFrontPublicKeys (List)
iam:ListDelegationRequests (List)
iam:ListEntitiesForPolicy (List)
iam:ListGroupPolicies (List)
iam:ListGroups (List)
iam:ListGroupsForUser (List)
iam:ListInstanceProfileTags (List)
iam:ListInstanceProfiles (List)
iam:ListInstanceProfilesForRole (List)
iam:ListMFADeviceTags (List)
iam:ListMFADevices (List)
iam:ListOpenIDConnectProviderTags (List)
iam:ListOpenIDConnectProviders (List)
iam:ListOrganizationsFeatures (List)
iam:ListPolicies (List)
iam:ListPoliciesGrantingServiceAccess (List)
iam:ListPolicyTags (List)
iam:ListPolicyVersions (List)
iam:ListRolePolicies (List)
iam:ListRoleTags (List)
iam:ListRoles (List)
iam:ListSAMLProviderTags (List)
iam:ListSAMLProviders (List)
iam:ListSSHPublicKeys (List)
iam:ListSTSRegionalEndpointsStatus (List)
iam:ListServerCertificateTags (List)
iam:ListServerCertificates (List)
iam:ListServiceSpecificCredentials (List)
iam:ListSigningCertificates (List)
iam:ListUserPolicies (List)
iam:ListUserTags (List)
iam:ListUsers (List)
iam:ListVirtualMFADevices (List)
iam:PassRole (Write)
iam:PutAccountProperties (Write)
iam:PutGroupPolicy (Permissions management)
iam:PutRolePermissionsBoundary (Permissions management)
iam:PutRolePolicy (Permissions management)
iam:PutUserPermissionsBoundary (Permissions management)
iam:PutUserPolicy (Permissions management)
iam:RejectDelegationRequest (Write)
iam:RemoveClientIDFromOpenIDConnectProvider (Write)
iam:RemoveRoleFromInstanceProfile (Write)
iam:RemoveUserFromGroup (Write)
iam:ResetServiceSpecificCredential (Write)
iam:ResyncMFADevice (Write)
iam:SendDelegationToken (Write)
iam:SetDefaultPolicyVersion (Permissions management)
iam:SetSTSRegionalEndpointStatus (Write)
iam:SetSecurityTokenServicePreferences (Write)
iam:SimulateCustomPolicy (Read)
iam:SimulatePrincipalPolicy (Read)
iam:TagInstanceProfile (Tagging)
iam:TagMFADevice (Tagging)
iam:TagOpenIDConnectProvider (Tagging)
iam:TagPolicy (Tagging)
iam:TagRole (Tagging)
iam:TagSAMLProvider (Tagging)
iam:TagServerCertificate (Tagging)
iam:TagUser (Tagging)
iam:UntagInstanceProfile (Tagging)
iam:UntagMFADevice (Tagging)
iam:UntagOpenIDConnectProvider (Tagging)
iam:UntagPolicy (Tagging)
iam:UntagRole (Tagging)
iam:UntagSAMLProvider (Tagging)
iam:UntagServerCertificate (Tagging)
iam:UntagUser (Tagging)
iam:UpdateAccessKey (Write)
iam:UpdateAccountEmailAddress (Write)
iam:UpdateAccountName (Write)
iam:UpdateAccountPasswordPolicy (Write)
iam:UpdateAssumeRolePolicy (Permissions management)
iam:UpdateCloudFrontPublicKey (Write)
iam:UpdateGroup (Write)
iam:UpdateLoginProfile (Write)
iam:UpdateOpenIDConnectProviderThumbprint (Write)
iam:UpdateRole (Write)
iam:UpdateRoleDescription (Write)
iam:UpdateSAMLProvider (Write)
iam:UpdateSSHPublicKey (Write)
iam:UpdateServerCertificate (Write)
iam:UpdateServiceSpecificCredential (Write)
iam:UpdateSigningCertificate (Write)
iam:UpdateUser (Write)
iam:UploadCloudFrontPublicKey (Write)
iam:UploadSSHPublicKey (Write)
iam:UploadServerCertificate (Write)
iam:UploadSigningCertificate (Write)

STS: 15 actions

sts:AssumeRole (Write)
sts:AssumeRoleWithSAML (Write)
sts:AssumeRoleWithWebIdentity (Write)
sts:DecodeAuthorizationMessage (Write)
sts:GetAccessKeyInfo (Read)
sts:GetCallerIdentity (Read)
sts:GetDelegatedAccessToken (Write)
sts:GetFederationToken (Write)
sts:GetServiceBearerToken (Read)
sts:GetSessionToken (Read)
sts:GetWebIdentityToken (Write)
sts:SetContext (Write)
sts:SetSourceIdentity (Write)
sts:TagGetWebIdentityToken (Tagging)
sts:TagSession (Tagging)

Data-plane actions (483)

By access level: 58 List, 3 Permissions management, 190 Read, 4 Tagging, 228 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
Agent Registry	All 3 actions (see the Agent Registry page)	1 List, 2 Read; 0 restricted, 0 conditional	NotAction:0
DevOps Agent	All 4 actions (see the DevOps Agent page)	4 Read; 0 restricted, 0 conditional	NotAction:0
MWAA	All 1 actions (see the MWAA page)	1 Write; 0 restricted, 0 conditional	NotAction:0
AppConfig	All 2 actions (see the AppConfig page)	1 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
Application Signals	All 2 actions (see the Application Signals page)	1 List, 1 Write; 0 restricted, 0 conditional	NotAction:0
B2BI	All 7 actions (see the B2BI page)	1 Read, 6 Write; 0 restricted, 0 conditional	NotAction:0
Bedrock	All 37 actions (see the Bedrock page)	3 List, 22 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
Bedrock-Agentcore	All 62 actions (see the Bedrock-Agentcore page)	13 List, 13 Read, 36 Write; 0 restricted, 0 conditional	NotAction:0
Keyspaces	All 2 actions (see the Keyspaces page)	2 Read; 0 restricted, 0 conditional	NotAction:0
CloudFront KeyValueStore	All 6 actions (see the CloudFront KeyValueStore page)	1 List, 2 Read, 3 Write; 0 restricted, 0 conditional	NotAction:0
CloudTrail-Data	All 1 actions (see the CloudTrail-Data page)	1 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch	All 5 actions (see the CloudWatch page)	1 List, 3 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
CodeGuru Profiler	All 2 actions (see the CodeGuru Profiler page)	2 Write; 0 restricted, 0 conditional	NotAction:0
Cognito Identity	All 5 actions (see the Cognito Identity page)	3 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Data Exchange	All 1 actions (see the Data Exchange page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Deadline Cloud	All 29 actions (see the Deadline Cloud page)	10 List, 12 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
DynamoDB	All 17 actions (see the DynamoDB page)	9 Read, 8 Write; 0 restricted, 0 conditional	NotAction:0
Elastic Block Store	All 4 actions (see the Elastic Block Store page)	3 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
EventBridge	All 3 actions (see the EventBridge page)	3 Write; 0 restricted, 0 conditional	NotAction:0
Firehose	All 2 actions (see the Firehose page)	2 Write; 0 restricted, 0 conditional	NotAction:0
GameLift Streams	All 12 actions (see the GameLift Streams page)	1 List, 4 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
Geo Maps	All 2 actions (see the Geo Maps page)	2 Read; 0 restricted, 0 conditional	NotAction:0
Geo Places	All 7 actions (see the Geo Places page)	7 Read; 0 restricted, 0 conditional	NotAction:0
Geo Routes	All 5 actions (see the Geo Routes page)	5 Read; 0 restricted, 0 conditional	NotAction:0
GuardDuty	All 1 actions (see the GuardDuty page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Connect Health	All 4 actions (see the Connect Health page)	2 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
IoT SiteWise	All 22 actions (see the IoT SiteWise page)	2 List, 13 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
IoT TwinMaker	All 3 actions (see the IoT TwinMaker page)	2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
Kendra Intelligent Ranking	All 1 actions (see the Kendra Intelligent Ranking page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Kinesis	All 5 actions (see the Kinesis page)	3 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Kinesis Video Streams	All 9 actions (see the Kinesis Video Streams page)	1 List, 6 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0
Lake Formation	All 1 actions (see the Lake Formation page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Lambda	All 14 actions (see the Lambda page)	1 Read, 13 Write; 0 restricted, 0 conditional	NotAction:0
Lex	All 6 actions (see the Lex page)	1 Read, 5 Write; 0 restricted, 0 conditional	NotAction:0
Machine Learning	All 1 actions (see the Machine Learning page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Managed Blockchain Query	All 9 actions (see the Managed Blockchain Query page)	5 List, 4 Read; 0 restricted, 0 conditional	NotAction:0
HealthImaging	All 1 actions (see the HealthImaging page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Pinpoint	All 4 actions (see the Pinpoint page)	4 Write; 0 restricted, 0 conditional	NotAction:0
Network Flow Monitor	All 12 actions (see the Network Flow Monitor page)	6 Read, 6 Write; 0 restricted, 0 conditional	NotAction:0
Nova Act	All 4 actions (see the Nova Act page)	4 Write; 0 restricted, 0 conditional	NotAction:0
Q Apps	All 18 actions (see the Q Apps page)	1 List, 4 Read, 13 Write; 0 restricted, 0 conditional	NotAction:0
Q Business	All 26 actions (see the Q Business page)	6 List, 8 Read, 12 Write; 0 restricted, 0 conditional	NotAction:0
QuickSight	All 2 actions (see the QuickSight page)	1 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
RDS Data API	All 6 actions (see the RDS Data API page)	6 Write; 0 restricted, 0 conditional	NotAction:0
CloudWatch RUM	All 1 actions (see the CloudWatch RUM page)	1 Write; 0 restricted, 0 conditional	NotAction:0
S3	All 25 actions (see the S3 page)	3 List, 3 Permissions management, 8 Read, 4 Tagging, 7 Write; 0 restricted, 0 conditional	NotAction:0
SageMaker	All 19 actions (see the SageMaker page)	1 List, 7 Read, 11 Write; 0 restricted, 0 conditional	NotAction:0
ASC	All 5 actions (see the ASC page)	2 List, 2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
Cloud Map	All 2 actions (see the Cloud Map page)	2 Read; 0 restricted, 0 conditional	NotAction:0
SES	All 2 actions (see the SES page)	2 Write; 0 restricted, 0 conditional	NotAction:0
Signer	All 1 actions (see the Signer page)	1 Read; 0 restricted, 0 conditional	NotAction:0
Pinpoint SMS Voice	All 8 actions (see the Pinpoint SMS Voice page)	1 Read, 7 Write; 0 restricted, 0 conditional	NotAction:0
SNS	All 1 actions (see the SNS page)	1 Write; 0 restricted, 0 conditional	NotAction:0
Social Messaging	All 6 actions (see the Social Messaging page)	6 Write; 0 restricted, 0 conditional	NotAction:0
Systems Manager	All 2 actions (see the Systems Manager page)	2 Read; 0 restricted, 0 conditional	NotAction:0
Step Functions	All 2 actions (see the Step Functions page)	2 Write; 0 restricted, 0 conditional	NotAction:0
SWF	All 19 actions (see the SWF page)	2 List, 6 Read, 11 Write; 0 restricted, 0 conditional	NotAction:0
Timestream	All 5 actions (see the Timestream page)	2 List, 2 Read, 1 Write; 0 restricted, 0 conditional	NotAction:0
User Experience Customization (UXC)	All 2 actions (see the User Experience Customization (UXC) page)	2 Read; 0 restricted, 0 conditional	NotAction:0
Well-Architected Tool	All 1 actions (see the Well-Architected Tool page)	1 Write; 0 restricted, 0 conditional	NotAction:0
X-Ray	All 12 actions (see the X-Ray page)	2 List, 8 Read, 2 Write; 0 restricted, 0 conditional	NotAction:0

Excluded and conditional actions

iam:CreateRole (not-action, statement 0): 1 matching actions
iam:CreateUser (not-action, statement 0): 1 matching actions
iam:DeleteRolePermissionsBoundary (not-action, statement 0): 1 matching actions
iam:PutRolePermissionsBoundary (not-action, statement 0): 1 matching actions
sts:AssumeRoot (not-action, statement 0): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: a4b (61 of 61), access-analyzer (15 of 15), account (12 of 12), acm (20 of 20), acm-pca (12 of 12), aco-automation (8 of 8), agent-registry (10 of 10), agentaccess-mcp (21 of 21), aidevops (45 of 45), and 357 more.
Grants data-plane write actions on a data store on all resources without conditions.
Grants iam:PassRole on all resources without conditions.
Grants permissions-management actions on iam on all resources without conditions.
Grants permissions-management actions on organizations on all resources without conditions.
Grants permissions-management actions on sso on all resources without conditions.
215 granted write or permissions-management actions have no data-plane classification from AWS, so the data-plane rule cannot assess them.
Can read secret values or decrypt data. Reads are not a High privilege rule.

Guidance

Practical scope

The first statement allows every action on Resource "*" except those matched by its NotAction list: iam:CreateRole, iam:CreateUser, iam:DeleteRolePermissionsBoundary, iam:PutRolePermissionsBoundary and sts:AssumeRoot. The second statement allows iam:CreateRole, iam:CreateUser and iam:PutRolePermissionsBoundary on Resource "*" only when iam:PermissionsBoundary matches arn:*:iam::aws:policy/AWSCODAPermissionsBoundary.

Use cases

Review the boundary that AWS CODA applies to the IAM roles it creates for delegations.

Best practices

AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

A permissions boundary sets the maximum permissions an identity-based policy can grant to a user or role and does not provide permissions on its own. The IAM User Guide says an entity can perform only the actions allowed by both its identity-based policies and its boundary.
The first statement uses NotAction with an Allow effect, so the maximum it sets is wide: every action except five IAM and STS actions. The IAM User Guide warns that NotAction with Allow could grant more permissions than you intended.
Creating roles or users, or setting a role's permissions boundary, is allowed only when the iam:PermissionsBoundary condition is this same boundary. iam:DeleteRolePermissionsBoundary and sts:AssumeRoot are not allowed.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide says you can use an AWS managed policy to set the boundary for a user or role. The description says AWS CODA uses this policy when it creates roles for delegations. A boundary gives no access without an identity-based policy.

Same domain

Frequently asked questions

When should I attach AWSCODAPermissionsBoundary?: The description says AWS CODA uses it when creating IAM roles for delegations, to define the boundary of their permissions. The reference page says you can attach it to your users, groups and roles, and the IAM User Guide says you can use an AWS managed policy to set a permissions boundary.
What does AWSCODAPermissionsBoundary grant?: As a permissions boundary it sets the maximum permissions: every action except iam:CreateRole, iam:CreateUser, iam:DeleteRolePermissionsBoundary, iam:PutRolePermissionsBoundary and sts:AssumeRoot, with iam:CreateRole, iam:CreateUser and iam:PutRolePermissionsBoundary allowed only when the iam:PermissionsBoundary condition is this same boundary. It does not provide permissions on its own.
What are the security risks of AWSCODAPermissionsBoundary?: The boundary allows nearly every action on all resources, so it limits little beyond IAM and STS. It uses NotAction with Allow, which the IAM User Guide warns could grant more permissions than you intended. An AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "NotAction": [
        "iam:CreateRole",
        "iam:CreateUser",
        "iam:DeleteRolePermissionsBoundary",
        "iam:PutRolePermissionsBoundary",
        "sts:AssumeRoot"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:CreateUser",
        "iam:PutRolePermissionsBoundary"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "iam:PermissionsBoundary": "arn:*:iam::aws:policy/AWSCODAPermissionsBoundary"
        }
      }
    }
  ]
}

Version history

Current version v1, edited by AWS on 2026-11-06. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary

Terraform

resource "aws_iam_role_policy_attachment" "awscodapermissionsboundary" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSCODAPermissionsBoundary"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSCODAPermissionsBoundary"),
);

Sources

AWSCODAPermissionsBoundary (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
Permissions boundaries for IAM entities (IAM User Guide) (retrieved 2026-11-13; supports securityConsiderations, assignmentGuidance, faqs)
IAM JSON policy elements: NotAction (IAM User Guide) (retrieved 2026-11-13; supports securityConsiderations, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices)