AWSContinuumCollectorServiceRolePolicy

OperatorService-linked roleActivePermissions reviewedShow on map Compare

Summary

Grants Amazon Continuum access to AWS services for discovering and reading configuration, assessing network reachability and security posture data in your account.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/aws-service-role/AWSContinuumCollectorServiceRolePolicy
Default version: v1
Created: 2026-10-16
Last edited: 2026-10-16
Services: access-analyzer, apigateway, ec2, ecr, eks, elasticloadbalancing, guardduty, iam, inspector2, lambda, s3, tiros, wafv2

Control-plane actions (41)

By access level: 14 List, 21 Read, 1 Tagging, 5 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Access Analyzer	2 of 37	1 List, 1 Read; 1 restricted, 1 conditional	access-analyzer:ListAnalyzers, access-analyzer:ListFindings
API Gateway	1 of 44	1 Read; 1 restricted, 1 conditional	apigateway:GET
EC2	7 of 834	2 List, 1 Tagging, 4 Write; 5 restricted, 5 conditional	ec2:CreateNetworkInsightsPath, ec2:CreateTags, ec2:DeleteNetworkInsightsAnalysis, ec2:DeleteNetworkInsightsPath, ec2:DescribeNetworkInsightsAnalyses, ec2:DescribeNetworkInsightsPaths, ec2:StartNetworkInsightsAnalysis
Elastic Container Registry	1 of 65	1 List; 1 restricted, 1 conditional	ecr:DescribeImages
EKS	5 of 74	3 List, 2 Read; 5 restricted, 5 conditional	eks:DescribeAccessEntry, eks:DescribePodIdentityAssociation, eks:ListAccessEntries, eks:ListAssociatedAccessPolicies, eks:ListPodIdentityAssociations
ELB	4 of 77	4 Read; 0 restricted, 0 conditional	elasticloadbalancing:DescribeListenerAttributes, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeTargetGroupAttributes, elasticloadbalancing:DescribeTargetHealth
GuardDuty	2 of 103	1 List, 1 Read; 2 restricted, 2 conditional	guardduty:GetFindings, guardduty:ListFindings
IAM	2 of 190	2 Read; 2 restricted, 0 conditional	iam:GetPolicy, iam:GetPolicyVersion
Inspector2	1 of 84	1 List; 0 restricted, 0 conditional	inspector2:ListFindings
Lambda	8 of 121	4 List, 4 Read; 7 restricted, 7 conditional	lambda:GetFunction, lambda:GetLayerVersion, lambda:GetLayerVersionPolicy, lambda:GetPolicy, lambda:ListAliases, lambda:ListEventSourceMappings, lambda:ListFunctionUrlConfigs, lambda:ListVersionsByFunction
S3	5 of 155	5 Read; 4 restricted, 4 conditional	s3:GetAccountPublicAccessBlock, s3:GetBucketAcl, s3:GetBucketLocation, s3:GetBucketPolicyStatus, s3:GetBucketPublicAccessBlock
Tiros	2 of 5	1 Read, 1 Write; 2 restricted, 2 conditional	tiros:CreateQuery, tiros:GetQueryAnswer
WAF V2	1 of 64	1 List; 1 restricted, 1 conditional	wafv2:ListResourcesForWebACL

Access Analyzer: 2 actions

access-analyzer:ListAnalyzers (List)
access-analyzer:ListFindings (Read)

API Gateway: 1 actions

apigateway:GET (Read)

EC2: 7 actions

ec2:CreateNetworkInsightsPath (Write)
ec2:CreateTags (Tagging)
ec2:DeleteNetworkInsightsAnalysis (Write)
ec2:DeleteNetworkInsightsPath (Write)
ec2:DescribeNetworkInsightsAnalyses (List)
ec2:DescribeNetworkInsightsPaths (List)
ec2:StartNetworkInsightsAnalysis (Write)

Elastic Container Registry: 1 actions

ecr:DescribeImages (List)

EKS: 5 actions

eks:DescribeAccessEntry (Read)
eks:DescribePodIdentityAssociation (Read)
eks:ListAccessEntries (List)
eks:ListAssociatedAccessPolicies (List)
eks:ListPodIdentityAssociations (List)

ELB: 4 actions

elasticloadbalancing:DescribeListenerAttributes (Read)
elasticloadbalancing:DescribeLoadBalancerAttributes (Read)
elasticloadbalancing:DescribeTargetGroupAttributes (Read)
elasticloadbalancing:DescribeTargetHealth (Read)

GuardDuty: 2 actions

guardduty:GetFindings (Read)
guardduty:ListFindings (List)

IAM: 2 actions

iam:GetPolicy (Read)
iam:GetPolicyVersion (Read)

Inspector2: 1 actions

inspector2:ListFindings (List)

Lambda: 8 actions

lambda:GetFunction (Read)
lambda:GetLayerVersion (Read)
lambda:GetLayerVersionPolicy (Read)
lambda:GetPolicy (Read)
lambda:ListAliases (List)
lambda:ListEventSourceMappings (List)
lambda:ListFunctionUrlConfigs (List)
lambda:ListVersionsByFunction (List)

S3: 5 actions

s3:GetAccountPublicAccessBlock (Read)
s3:GetBucketAcl (Read)
s3:GetBucketLocation (Read)
s3:GetBucketPolicyStatus (Read)
s3:GetBucketPublicAccessBlock (Read)

Tiros: 2 actions

tiros:CreateQuery (Write)
tiros:GetQueryAnswer (Read)

WAF V2: 1 actions

wafv2:ListResourcesForWebACL (List)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: No (service-linked role policy).

Why this tier

Grants 6 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LambdaFunctionSupplementalMetadataRead",
      "Effect": "Allow",
      "Action": [
        "lambda:GetPolicy",
        "lambda:ListAliases",
        "lambda:ListVersionsByFunction",
        "lambda:ListFunctionUrlConfigs",
        "lambda:GetFunction"
      ],
      "Resource": "arn:aws:lambda:*:*:function:*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaLayerVersionSupplementalMetadataRead",
      "Effect": "Allow",
      "Action": [
        "lambda:GetLayerVersion",
        "lambda:GetLayerVersionPolicy"
      ],
      "Resource": "arn:aws:lambda:*:*:layer:*:*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "LambdaEventSourceMappingRead",
      "Effect": "Allow",
      "Action": "lambda:ListEventSourceMappings",
      "Resource": "*"
    },
    {
      "Sid": "IamAwsManagedPolicyDocumentRead",
      "Effect": "Allow",
      "Action": [
        "iam:GetPolicy",
        "iam:GetPolicyVersion"
      ],
      "Resource": "arn:aws:iam::aws:policy/*"
    },
    {
      "Sid": "AccessAnalyzerFindingsRead",
      "Effect": "Allow",
      "Action": "access-analyzer:ListFindings",
      "Resource": "arn:aws:access-analyzer:*:*:analyzer/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "GuardDutyFindingsRead",
      "Effect": "Allow",
      "Action": [
        "guardduty:ListFindings",
        "guardduty:GetFindings"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "EcrPrivateImageMetadataRead",
      "Effect": "Allow",
      "Action": "ecr:DescribeImages",
      "Resource": "arn:aws:ecr:*:*:repository/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Wafv2ResourceAssociationRead",
      "Effect": "Allow",
      "Action": "wafv2:ListResourcesForWebACL",
      "Resource": [
        "arn:aws:wafv2:*:*:regional/webacl/*/*",
        "arn:aws:wafv2:us-east-1:*:global/webacl/*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ApiGatewaySupplementalMetadataRead",
      "Effect": "Allow",
      "Action": "apigateway:GET",
      "Resource": [
        "arn:aws:apigateway:*::/restapis/*/resources",
        "arn:aws:apigateway:*::/restapis/*/stages/*/exports/*",
        "arn:aws:apigateway:*::/restapis/*/authorizers",
        "arn:aws:apigateway:*::/domainnames",
        "arn:aws:apigateway:*::/domainnames/*/basepathmappings",
        "arn:aws:apigateway:*::/apis/*/exports/*",
        "arn:aws:apigateway:*::/apis/*/routes",
        "arn:aws:apigateway:*::/apis/*/authorizers",
        "arn:aws:apigateway:*::/domainnames/*/apimappings"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Elbv2SupplementalMetadataRead",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeListenerAttributes",
        "elasticloadbalancing:DescribeTargetGroupAttributes",
        "elasticloadbalancing:DescribeTargetHealth"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EksSupplementalMetadataRead",
      "Effect": "Allow",
      "Action": [
        "eks:ListPodIdentityAssociations",
        "eks:DescribePodIdentityAssociation",
        "eks:ListAccessEntries",
        "eks:DescribeAccessEntry",
        "eks:ListAssociatedAccessPolicies"
      ],
      "Resource": [
        "arn:aws:eks:*:*:cluster/*",
        "arn:aws:eks:*:*:podidentityassociation/*",
        "arn:aws:eks:*:*:access-entry/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "NetworkInsightsRead",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInsightsAnalyses"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateTaggedNetworkInsightsPath",
      "Effect": "Allow",
      "Action": "ec2:CreateNetworkInsightsPath",
      "Resource": "arn:aws:ec2:*:*:network-insights-path/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:RequestTag/AWSContinuum": "true"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "AWSContinuum"
        }
      }
    },
    {
      "Sid": "CreateTaggedNetworkInsightsAnalysis",
      "Effect": "Allow",
      "Action": "ec2:StartNetworkInsightsAnalysis",
      "Resource": "arn:aws:ec2:*:*:network-insights-analysis/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:RequestTag/AWSContinuum": "true"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "AWSContinuum"
        }
      }
    },
    {
      "Sid": "UseTaggedNetworkInsightsPath",
      "Effect": "Allow",
      "Action": "ec2:StartNetworkInsightsAnalysis",
      "Resource": "arn:aws:ec2:*:*:network-insights-path/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/AWSContinuum": "true"
        }
      }
    },
    {
      "Sid": "TagNetworkInsightsResourcesOnCreate",
      "Effect": "Allow",
      "Action": "ec2:CreateTags",
      "Resource": [
        "arn:aws:ec2:*:*:network-insights-path/*",
        "arn:aws:ec2:*:*:network-insights-analysis/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:RequestTag/AWSContinuum": "true",
          "ec2:CreateAction": [
            "CreateNetworkInsightsPath",
            "StartNetworkInsightsAnalysis"
          ]
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "AWSContinuum"
        }
      }
    },
    {
      "Sid": "DeleteTaggedNetworkInsightsResources",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteNetworkInsightsAnalysis",
        "ec2:DeleteNetworkInsightsPath"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:network-insights-path/*",
        "arn:aws:ec2:*:*:network-insights-analysis/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "aws:ResourceTag/AWSContinuum": "true"
        }
      }
    },
    {
      "Sid": "TirosQueryRead",
      "Effect": "Allow",
      "Action": [
        "tiros:CreateQuery",
        "tiros:GetQueryAnswer"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecurityServiceDiscoveryAndFindings",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:ListAnalyzers",
        "inspector2:ListFindings"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3AccountPublicAccessRead",
      "Effect": "Allow",
      "Action": "s3:GetAccountPublicAccessBlock",
      "Resource": "*"
    },
    {
      "Sid": "S3BucketExposureRead",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetBucketLocation",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPublicAccessBlock"
      ],
      "Resource": "arn:aws:s3:::*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}

Version history

Current version v1, edited by AWS on 2026-10-16. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

This policy cannot be attached to users, groups or roles, so there are no attach snippets.

Sources

Pending editorial review. No editorial sources are listed yet.