AWSElasticDisasterRecoveryReadOnlyAccess

Summary

Provides permissions to all read-only public APIs of AWS Elastic Disaster Recovery (DRS), plus some read-only APIs of other AWS services needed to make full read-only use of the DRS console. The DRS User Guide says it suits team members who need visibility into a disaster recovery setup, such as auditors or monitoring teams, without the ability to make changes.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccessCopy ARN

Default version

v6

Created

2021-11-17

Last edited

2026-08-18

Services

drs, ec2, iam, ssm

Control-plane actions (32)

By access level: 7 List, 25 Read.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AIOpsOperatorAccess
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary

Same domain

• AWSAgentlessDiscoveryService
• AWSApplicationDiscoveryAgentAccess
• AWSApplicationDiscoveryServiceFullAccess
• AWSApplicationMigrationAgentInstallationPolicy
• AWSApplicationMigrationAgentPolicy
• AWSApplicationMigrationAgentPolicy_v2
• AWSApplicationMigrationConversionServerPolicy
• AWSApplicationMigrationFullAccess

Frequently asked questions

When should I attach AWSElasticDisasterRecoveryReadOnlyAccess?

The reference page says you can attach AWSElasticDisasterRecoveryReadOnlyAccess to your users, groups and roles, and describes it as: you can attach the AWSElasticDisasterRecoveryReadOnlyAccess policy to your IAM identities and it provides permissions to all read-only public APIs of Elastic Disaster Recovery. Attach it where read-only visibility into Elastic Disaster Recovery is the intended scope.

What does AWSElasticDisasterRecoveryReadOnlyAccess grant?

It allows 21 drs read actions on all resources, 5 EC2 read actions, iam:ListRoles, ssm:ListCommandInvocations, and narrower SSM read actions on parameter, document and automation-execution ARNs.

What are the security risks of AWSElasticDisasterRecoveryReadOnlyAccess?

It has no drs write actions, but it includes read actions for EC2, IAM roles and SSM outside DRS, and ssm:GetParameter on parameters matching arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DRSReadOnlyAccess1",
      "Effect": "Allow",
      "Action": [
        "drs:DescribeJobLogItems",
        "drs:DescribeJobs",
        "drs:DescribeRecoveryInstances",
        "drs:DescribeRecoverySnapshots",
        "drs:DescribeReplicationConfigurationTemplates",
        "drs:DescribeSourceServers",
        "drs:GetFailbackReplicationConfiguration",
        "drs:GetLaunchConfiguration",
        "drs:GetReplicationConfiguration",
        "drs:ListExtensibleSourceServers",
        "drs:ListStagingAccounts",
        "drs:ListTagsForResource",
        "drs:ListLaunchActions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DRSReadOnlyAccess2",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:GetInstanceTypesFromInstanceRequirements"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DRSReadOnlyAccess4",
      "Effect": "Allow",
      "Action": "iam:ListRoles",
      "Resource": "*"
    },
    {
      "Sid": "DRSReadOnlyAccess5",
      "Effect": "Allow",
      "Action": "ssm:ListCommandInvocations",
      "Resource": "*"
    },
    {
      "Sid": "DRSReadOnlyAccess6",
      "Effect": "Allow",
      "Action": "ssm:GetParameter",
      "Resource": "arn:aws:ssm:*:*:parameter/ManagedByAWSElasticDisasterRecovery-*"
    },
    {
      "Sid": "DRSReadOnlyAccess7",
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeDocument",
        "ssm:GetDocument"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:document/AWS-CreateImage",
        "arn:aws:ssm:*:*:document/AWSMigration-ValidateNetworkConnectivity",
        "arn:aws:ssm:*:*:document/AWSMigration-VerifyMountedVolumes",
        "arn:aws:ssm:*:*:document/AWSMigration-ValidateHttpResponse",
        "arn:aws:ssm:*:*:document/AWSMigration-ValidateDiskSpace",
        "arn:aws:ssm:*:*:document/AWSMigration-VerifyProcessIsRunning",
        "arn:aws:ssm:*:*:document/AWSMigration-LinuxTimeSyncSetting",
        "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure"
      ]
    },
    {
      "Sid": "DRSReadOnlyAccess8",
      "Effect": "Allow",
      "Action": [
        "ssm:GetAutomationExecution"
      ],
      "Resource": "arn:aws:ssm:*:*:automation-execution/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AWSElasticDisasterRecoveryManaged": "false"
        }
      }
    },
    {
      "Sid": "DRSReadOnlyAccess9",
      "Effect": "Allow",
      "Action": [
        "drs:GetRecoveryPlan",
        "drs:ListRecoveryPlans",
        "drs:GetRecoveryPlanStep",
        "drs:ListRecoveryPlanSteps",
        "drs:GetRecoveryPlanExecution",
        "drs:ListRecoveryPlanExecutions",
        "drs:GetRecoveryPlanExecutionStep",
        "drs:ListRecoveryPlanExecutionSteps"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v6, edited by AWS on 2026-08-18. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess

resource "aws_iam_role_policy_attachment" "awselasticdisasterrecoveryreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSElasticDisasterRecoveryReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSElasticDisasterRecoveryReadOnlyAccess"),
);

Sources

• AWSElasticDisasterRecoveryReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policy: AWSElasticDisasterRecoveryReadOnlyAccess (retrieved 2026-11-13; supports summary, useCases, assignmentGuidance, faqs)
• AWS managed policies for AWS Elastic Disaster Recovery (retrieved 2026-11-13; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports faqs)

• Official AWS reference for AWSElasticDisasterRecoveryReadOnlyAccess
• AWS service guide
• Report a data issue