When should I attach AWSMcpServiceActionsFullAccess?

The IAM User Guide says to use it when a user requires access to AWS services using AWS MCP servers and you do not need to specify permissions per AWS MCP service. The reference page says you can attach it to your users, groups and roles.

What does AWSMcpServiceActionsFullAccess grant?

It allows Action "*" on Resource "*" only when aws:IsMcpServiceAction is true, so it covers MCP service actions. It does not grant permissions for actions the MCP service takes on other AWS services; those must be granted separately.

What are the security risks of AWSMcpServiceActionsFullAccess?

The wildcard action is limited by the aws:IsMcpServiceAction condition, which is set to True only when the MCP service is authorizing an MCP service action. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to.

AWSMcpServiceActionsFullAccess

OperatorAWS managedActiveReviewedShow on map Compare

Summary

Provides full access to all MCP service actions. The reference page says this policy does not grant access to the actions taken by the MCP, only the MCP actions themselves.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess
Default version: v3
Created: 2025-11-21
Last edited: 2026-02-12
Services: a2c, a4b, access-analyzer, account, account-access, acm, acm-pca, aco-automation, action-recommendations, activate, agent-registry, agentaccess-mcp, aidevops, aiops, airflow, airflow-serverless, amplify, amplifybackend, amplifyuibuilder, aoss, apigateway, app-integrations, appconfig, appfabric, appflow, application-autoscaling, application-signals, application-signals-mcp, application-transformation, applicationinsights, appmesh, appmesh-preview, apprunner, appstream, appstudio, appsync, apptest, aps, arc-region-switch, arc-zonal-shift, arsenal, artifact, assurance, athena, auditmanager, autoscaling, autoscaling-plans, aws-external-anthropic, aws-marketplace, aws-marketplace-management, aws-portal, awsconnector, b2bi, backup, backup-gateway, backup-search, backup-storage, batch, bcm-dashboards, bcm-data-exports, bcm-pricing-calculator, bcm-recommended-actions, bedrock, bedrock-agentcore, bedrock-mantle, bedrock-websearch, billing, billingconductor, braket, budgets, bugbust, cases, cassandra, ce, chatbot, chime, cleanrooms, cleanrooms-ml, cloud9, clouddirectory, cloudformation, cloudfront, cloudfront-keyvaluestore, cloudhsm, cloudsearch, cloudshell, cloudtrail, cloudtrail-data, cloudwatch, codeartifact, codebuild, codecatalyst, codecommit, codeconnections, codedeploy, codedeploy-commands-secure, codeguru, codeguru-profiler, codeguru-reviewer, codeguru-security, codepipeline, codestar-connections, codestar-notifications, codewhisperer, cognito-identity, cognito-idp, cognito-sync, comprehend, comprehendmedical, compute-optimizer, config, connect, connect-campaigns, consoleapp, consolidatedbilling, continuum, controlcatalog, controltower, cost-optimization-hub, cur, customer-verification, databrew, dataexchange, datapipeline, datasync, datazone, dax, dbqms, deadline, detective, devicefarm, devops-guru, directconnect, discovery, dlm, dms, docdb-elastic, drs, ds, ds-data, dsql, dynamodb, ebs, ec2, ec2-instance-connect, ec2messages, ecr, ecr-public, ecs, ecs-mcp, eks, eks-auth, eks-mcp, elasticache, elasticbeanstalk, elasticfilesystem, elasticloadbalancing, elasticmapreduce, elastictranscoder, elemental-activations, elemental-appliances-software, elemental-inference, elemental-support-cases, elemental-support-content, emr-containers, emr-serverless, end-user-messaging, entityresolution, es, events, eventsbilltoaws, evs, execute-api, finops-agent, finspace, finspace-api, firehose, fis, fms, forecast, frauddetector, freertos, freetier, fsx, gamelift, gameliftstreams, geo, geo-maps, geo-places, geo-routes, glacier, globalaccelerator, glue, grafana, greengrass, groundstation, groundtruthlabeling, guardduty, health, health-agent, healthlake, honeycode, iam, identity-sync, identitystore, identitystore-auth, imagebuilder, importexport, inspector, inspector-scan, inspector2, inspector2-telemetry, interconnect, internetmonitor, invoicing, iot, iot-device-tester, iotanalytics, iotdeviceadvisor, iotfleethub, iotfleetwise, iotjobsdata, iotmanagedintegrations, iotsitewise, iottwinmaker, iotwireless, iq, iq-permission, ivs, ivschat, kafka, kafka-cluster, kafkaconnect, kendra, kendra-ranking, kinesis, kinesisanalytics, kinesisvideo, kms, lakeformation, lambda, launchwizard, lex, license-manager, license-manager-linux-subscriptions, license-manager-user-subscriptions, lightsail, logs, lookoutequipment, lookoutmetrics, lookoutvision, m2, machinelearning, macie2, managedblockchain, managedblockchain-query, mapcredits, marketplacecommerceanalytics, mechanicalturk, mediaconnect, mediaconvert, mediaimport, medialive, mediapackage, mediapackage-vod, mediapackagev2, mediastore, mediatailor, medical-imaging, memorydb, mgh, mgn, migrationhub-orchestrator, migrationhub-strategy, mobileanalytics, mobiletargeting, monitron, mpa, mq, neptune-db, neptune-graph, network-firewall, network-security-director, network-security-manager, networkflowmonitor, networkmanager, networkmanager-chat, networkmonitor, nimble, notifications, notifications-contacts, nova-act, oam, observabilityadmin, odb, omics, one, opensearch, opsworks, opsworks-cm, organizations, osis, outposts, panorama, partnercentral, partnercentral-account-management, payment-cryptography, payments, pca-connector-ad, pca-connector-scep, pcs, personalize, pi, pipes, polly, pricing, pricingplanmanager, private-networks, profile, proton, purchase-orders, q, qapps, qbusiness, qdeveloper, qldb, quicksight, ram, rbin, rds, rds-data, rds-db, redshift, redshift-data, redshift-serverless, refactor-spaces, rekognition, repostspace, researchstudio, resiliencehub, resource-explorer, resource-explorer-2, resource-groups, rhelkb, robomaker, rolesanywhere, route53, route53-recovery-cluster, route53-recovery-control-config, route53-recovery-readiness, route53domains, route53globalresolver, route53profiles, route53resolver, rtbfabric, rum, s3, s3-object-lambda, s3-outposts, s3express, s3files, s3tables, s3vectors, sagemaker, sagemaker-data-science-assistant, sagemaker-geospatial, sagemaker-mlflow, sagemaker-unified-studio-mcp, savingsplans, scheduler, schemas, scn, sdb, secretsmanager, security-ir, securityagent, securityhub, securitylake, serverlessrepo, servicecatalog, servicediscovery, serviceextract, servicequotas, ses, shield, signer, signin, simspaceweaver, sms, sms-voice, snow-device-management, snowball, sns, social-messaging, sqlworkbench, sqs, ssm, ssm-contacts, ssm-guiconnect, ssm-incidents, ssm-quicksetup, ssm-sap, ssmmessages, sso, sso-directory, sso-oauth, startups, states, storagegateway, sts, support, support-console, supportapp, supportauthz, supportplans, sustainability, swf, synthetics, tag, tax, textract, thinclient, timestream, timestream-influxdb, tiros, tnb, transcribe, transfer, transform, transform-custom, translate, trustedadvisor, ts, user-subscriptions, uxc, vendor-insights, verified-access, verifiedpermissions, voiceid, vpc-lattice, vpc-lattice-svcs, vpce, waf, waf-regional, wafv2, wam, wellarchitected, wickr, wisdom, workdocs, worklink, workmail, workmailmessageflow, workspaces, workspaces-instances, workspaces-web, xray

Control-plane actions (22045)

By access level: 3723 List, 431 Permissions management, 5814 Read, 717 Tagging, 11360 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
App2Container	All 4 actions (see the App2Container page)	2 Read, 2 Write; 4 restricted, 4 conditional	*
Alexa for Business	All 96 actions (see the Alexa for Business page)	17 List, 16 Read, 2 Tagging, 61 Write; 96 restricted, 96 conditional	*
Access Analyzer	All 37 actions (see the Access Analyzer page)	3 List, 17 Read, 2 Tagging, 15 Write; 37 restricted, 37 conditional	*
Account	All 20 actions (see the Account page)	1 List, 7 Read, 12 Write; 20 restricted, 20 conditional	*
Account access manager	All 11 actions (see the Account access manager page)	2 List, 3 Read, 2 Tagging, 4 Write; 11 restricted, 11 conditional	*
Certificate Manager	All 42 actions (see the Certificate Manager page)	7 List, 11 Read, 4 Tagging, 20 Write; 42 restricted, 42 conditional	*
Private Certificate Authority	All 23 actions (see the Private Certificate Authority page)	1 List, 4 Permissions management, 8 Read, 2 Tagging, 8 Write; 23 restricted, 23 conditional	*
Compute Optimizer Automation	All 23 actions (see the Compute Optimizer Automation page)	10 List, 3 Read, 2 Tagging, 8 Write; 23 restricted, 23 conditional	*
Action Recommendations	All 1 actions (see the Action Recommendations page)	1 List; 1 restricted, 1 conditional	*
Activate	All 8 actions (see the Activate page)	6 Read, 2 Write; 8 restricted, 8 conditional	*
Agent Registry	All 19 actions (see the Agent Registry page)	3 List, 4 Read, 2 Tagging, 10 Write; 19 restricted, 19 conditional	*
WorkSpaces AgentAccess MCP	All 25 actions (see the WorkSpaces AgentAccess MCP page)	4 Read, 21 Write; 25 restricted, 25 conditional	*
DevOps Agent	All 90 actions (see the DevOps Agent page)	24 List, 1 Permissions management, 19 Read, 2 Tagging, 44 Write; 90 restricted, 90 conditional	*
AI Operations	All 33 actions (see the AI Operations page)	7 List, 9 Read, 2 Tagging, 15 Write; 33 restricted, 33 conditional	*
MWAA	All 12 actions (see the MWAA page)	1 List, 2 Read, 2 Tagging, 7 Write; 12 restricted, 12 conditional	*
MWAA Serverless	All 16 actions (see the MWAA Serverless page)	4 List, 5 Read, 2 Tagging, 5 Write; 16 restricted, 16 conditional	*
Amplify	All 41 actions (see the Amplify page)	8 List, 9 Read, 2 Tagging, 22 Write; 41 restricted, 41 conditional	*
Amplify Admin	All 31 actions (see the Amplify Admin page)	2 List, 7 Read, 22 Write; 31 restricted, 31 conditional	*
Amplify UI Builder	All 29 actions (see the Amplify UI Builder page)	5 List, 8 Read, 2 Tagging, 14 Write; 29 restricted, 29 conditional	*
OpenSearch Serverless	All 57 actions (see the OpenSearch Serverless page)	10 List, 13 Read, 2 Tagging, 32 Write; 57 restricted, 57 conditional	*
API Gateway	All 44 actions (see the API Gateway page)	5 List, 10 Permissions management, 7 Read, 22 Write; 44 restricted, 44 conditional	*
AppIntegrations	All 35 actions (see the AppIntegrations page)	7 List, 7 Read, 2 Tagging, 19 Write; 35 restricted, 35 conditional	*
AppConfig	All 56 actions (see the AppConfig page)	11 List, 13 Read, 2 Tagging, 30 Write; 56 restricted, 56 conditional	*
AppFabric	All 26 actions (see the AppFabric page)	4 List, 5 Read, 2 Tagging, 15 Write; 26 restricted, 26 conditional	*
AppFlow	All 31 actions (see the AppFlow page)	3 List, 11 Read, 2 Tagging, 15 Write; 31 restricted, 31 conditional	*
Application Auto Scaling	All 14 actions (see the Application Auto Scaling page)	1 List, 5 Read, 2 Tagging, 6 Write; 14 restricted, 14 conditional	*
Application Signals	All 30 actions (see the Application Signals page)	8 List, 9 Read, 2 Tagging, 11 Write; 30 restricted, 30 conditional	*
Application Signals MCP	All 2 actions (see the Application Signals MCP page)	2 Read; 2 restricted, 2 conditional	*
Application Transformation Service	All 14 actions (see the Application Transformation Service page)	6 Read, 8 Write; 14 restricted, 14 conditional	*
CloudWatch Application Insights	All 34 actions (see the CloudWatch Application Insights page)	7 List, 10 Read, 2 Tagging, 15 Write; 34 restricted, 34 conditional	*
App Mesh	All 42 actions (see the App Mesh page)	8 List, 9 Read, 2 Tagging, 23 Write; 42 restricted, 42 conditional	*
App Mesh Preview	All 39 actions (see the App Mesh Preview page)	7 List, 9 Read, 23 Write; 39 restricted, 39 conditional	*
App Runner	All 42 actions (see the App Runner page)	9 List, 9 Read, 2 Tagging, 22 Write; 42 restricted, 42 conditional	*
AppStream 2.0	All 90 actions (see the AppStream 2.0 page)	19 List, 6 Read, 2 Tagging, 63 Write; 90 restricted, 90 conditional	*
App Studio	All 5 actions (see the App Studio page)	2 Read, 3 Write; 5 restricted, 5 conditional	*
AppSync	All 87 actions (see the AppSync page)	13 List, 1 Permissions management, 20 Read, 2 Tagging, 51 Write; 87 restricted, 87 conditional	*
Mainframe Modernization Application Testing	All 24 actions (see the Mainframe Modernization Application Testing page)	4 List, 7 Read, 2 Tagging, 11 Write; 24 restricted, 24 conditional	*
AMP	All 61 actions (see the AMP page)	4 List, 25 Read, 2 Tagging, 30 Write; 61 restricted, 61 conditional	*
ARC Region switch	All 25 actions (see the ARC Region switch page)	7 List, 3 Permissions management, 5 Read, 2 Tagging, 8 Write; 25 restricted, 25 conditional	*
ARC Zonal Shift	All 15 actions (see the ARC Zonal Shift page)	3 List, 2 Read, 10 Write; 15 restricted, 15 conditional	*
Application Discovery Arsenal	All 1 actions (see the Application Discovery Arsenal page)	1 Write; 1 restricted, 1 conditional	*
Artifact	All 24 actions (see the Artifact page)	6 List, 10 Read, 2 Tagging, 6 Write; 24 restricted, 24 conditional	*
Assurance	All 96 actions (see the Assurance page)	47 Read, 2 Tagging, 47 Write; 96 restricted, 96 conditional	*
Athena	All 86 actions (see the Athena page)	13 List, 35 Read, 2 Tagging, 36 Write; 86 restricted, 86 conditional	*
Audit Manager	All 62 actions (see the Audit Manager page)	12 List, 19 Read, 2 Tagging, 29 Write; 62 restricted, 62 conditional	*
EC2 Auto Scaling	All 68 actions (see the EC2 Auto Scaling page)	22 List, 1 Read, 2 Tagging, 43 Write; 68 restricted, 68 conditional	*
Auto Scaling	All 6 actions (see the Auto Scaling page)	3 Read, 3 Write; 6 restricted, 6 conditional	*
Claude Platform on AWS	All 83 actions (see the Claude Platform on AWS page)	15 List, 16 Read, 2 Tagging, 50 Write; 83 restricted, 83 conditional	*
Marketplace	All 97 actions (see the Marketplace page)	27 List, 2 Permissions management, 30 Read, 2 Tagging, 36 Write; 97 restricted, 97 conditional	*
Marketplace Portal	All 13 actions (see the Marketplace Portal page)	4 List, 4 Read, 5 Write; 13 restricted, 13 conditional	*
Billing Console	All 9 actions (see the Billing Console page)	5 Read, 4 Write; 9 restricted, 9 conditional	*
Connector Service	All 3 actions (see the Connector Service page)	2 Read, 1 Write; 3 restricted, 3 conditional	*
B2BI	All 23 actions (see the B2BI page)	4 List, 5 Read, 2 Tagging, 12 Write; 23 restricted, 23 conditional	*
Backup	All 122 actions (see the Backup page)	31 List, 6 Permissions management, 32 Read, 2 Tagging, 51 Write; 122 restricted, 122 conditional	*
Backup Gateway	All 27 actions (see the Backup Gateway page)	9 Read, 2 Tagging, 16 Write; 27 restricted, 27 conditional	*
Backup Search	All 12 actions (see the Backup Search page)	2 List, 5 Read, 2 Tagging, 3 Write; 12 restricted, 12 conditional	*
Backup Storage	All 15 actions (see the Backup Storage page)	15 Write; 15 restricted, 15 conditional	*
Batch	All 46 actions (see the Batch page)	5 List, 12 Read, 3 Tagging, 26 Write; 46 restricted, 46 conditional	*
Billing and Cost Management Dashboards	All 15 actions (see the Billing and Cost Management Dashboards page)	1 List, 5 Read, 2 Tagging, 7 Write; 15 restricted, 15 conditional	*
BillingAndCostManagementDataExports	All 12 actions (see the BillingAndCostManagementDataExports page)	3 List, 4 Read, 2 Tagging, 3 Write; 12 restricted, 12 conditional	*
Pricing Calculator	All 36 actions (see the Pricing Calculator page)	10 List, 4 Read, 3 Tagging, 19 Write; 36 restricted, 36 conditional	*
BillingAndCostManagementRecommendedActions	All 1 actions (see the BillingAndCostManagementRecommendedActions page)	1 List; 1 restricted, 1 conditional	*
Bedrock	All 232 actions (see the Bedrock page)	45 List, 1 Permissions management, 61 Read, 2 Tagging, 123 Write; 232 restricted, 232 conditional	*
Bedrock-Agentcore	All 197 actions (see the Bedrock-Agentcore page)	38 List, 8 Permissions management, 45 Read, 2 Tagging, 104 Write; 197 restricted, 197 conditional	*
Bedrock Mantle	All 38 actions (see the Bedrock Mantle page)	8 List, 10 Read, 2 Tagging, 18 Write; 38 restricted, 38 conditional	*
Bedrock Web Search	All 3 actions (see the Bedrock Web Search page)	3 Read; 3 restricted, 3 conditional	*
Billing	All 47 actions (see the Billing page)	6 List, 3 Permissions management, 21 Read, 2 Tagging, 15 Write; 47 restricted, 47 conditional	*
Billing Conductor	All 34 actions (see the Billing Conductor page)	4 List, 9 Read, 2 Tagging, 19 Write; 34 restricted, 34 conditional	*
Braket	All 20 actions (see the Braket page)	3 List, 7 Read, 2 Tagging, 8 Write; 20 restricted, 20 conditional	*
Budget	All 13 actions (see the Budget page)	6 Read, 2 Tagging, 5 Write; 13 restricted, 13 conditional	*
BugBust	All 17 actions (see the BugBust page)	1 List, 8 Read, 2 Tagging, 6 Write; 17 restricted, 17 conditional	*
Connect Cases	All 43 actions (see the Connect Cases page)	7 List, 12 Read, 2 Tagging, 22 Write; 43 restricted, 43 conditional	*
Keyspaces	All 19 actions (see the Keyspaces page)	1 List, 3 Read, 4 Tagging, 11 Write; 19 restricted, 19 conditional	*
Cost Explorer Service	All 59 actions (see the Cost Explorer Service page)	6 List, 29 Read, 2 Tagging, 22 Write; 59 restricted, 59 conditional	*
Chatbot	All 39 actions (see the Chatbot page)	1 List, 15 Read, 2 Tagging, 21 Write; 39 restricted, 39 conditional	*
Chime	All 316 actions (see the Chime page)	50 List, 70 Read, 6 Tagging, 190 Write; 316 restricted, 316 conditional	*
Clean Rooms	All 107 actions (see the Clean Rooms page)	24 List, 29 Read, 2 Tagging, 52 Write; 107 restricted, 107 conditional	*
Clean Rooms ML	All 59 actions (see the Clean Rooms ML page)	17 List, 1 Permissions management, 14 Read, 2 Tagging, 25 Write; 59 restricted, 59 conditional	*
Cloud9	All 29 actions (see the Cloud9 page)	14 Read, 2 Tagging, 13 Write; 29 restricted, 29 conditional	*
Cloud Directory	All 66 actions (see the Cloud Directory page)	5 List, 25 Read, 2 Tagging, 34 Write; 66 restricted, 66 conditional	*
CloudFormation	All 104 actions (see the CloudFormation page)	23 List, 1 Permissions management, 34 Read, 2 Tagging, 44 Write; 104 restricted, 104 conditional	*
CloudFront	All 173 actions (see the CloudFront page)	41 List, 1 Permissions management, 45 Read, 2 Tagging, 84 Write; 173 restricted, 173 conditional	*
CloudHSM	All 18 actions (see the CloudHSM page)	2 Permissions management, 4 Read, 2 Tagging, 10 Write; 18 restricted, 18 conditional	*
CloudSearch	All 32 actions (see the CloudSearch page)	2 List, 1 Permissions management, 11 Read, 2 Tagging, 16 Write; 32 restricted, 32 conditional	*
CloudShell	All 11 actions (see the CloudShell page)	1 List, 2 Read, 8 Write; 11 restricted, 11 conditional	*
CloudTrail	All 66 actions (see the CloudTrail page)	8 List, 21 Read, 2 Tagging, 35 Write; 66 restricted, 66 conditional	*
CloudWatch	All 160 actions (see the CloudWatch page)	24 List, 8 Permissions management, 46 Read, 2 Tagging, 80 Write; 160 restricted, 160 conditional	*
CodeArtifact	All 51 actions (see the CodeArtifact page)	12 List, 2 Permissions management, 13 Read, 2 Tagging, 22 Write; 51 restricted, 51 conditional	*
CodeBuild	All 67 actions (see the CodeBuild page)	18 List, 2 Permissions management, 12 Read, 35 Write; 67 restricted, 67 conditional	*
CodeCatalyst	All 30 actions (see the CodeCatalyst page)	5 List, 5 Read, 2 Tagging, 18 Write; 30 restricted, 30 conditional	*
CodeCommit	All 91 actions (see the CodeCommit page)	8 List, 35 Read, 2 Tagging, 46 Write; 91 restricted, 91 conditional	*
CodeConnections	All 38 actions (see the CodeConnections page)	7 List, 16 Read, 2 Tagging, 13 Write; 38 restricted, 38 conditional	*
CodeDeploy	All 48 actions (see the CodeDeploy page)	17 List, 8 Read, 4 Tagging, 19 Write; 48 restricted, 48 conditional	*
CodeDeploy Commands Secure	All 4 actions (see the CodeDeploy Commands Secure page)	2 Read, 2 Write; 4 restricted, 4 conditional	*
CodeGuru	All 1 actions (see the CodeGuru page)	1 Read; 1 restricted, 1 conditional	*
CodeGuru Profiler	All 21 actions (see the CodeGuru Profiler page)	5 List, 2 Permissions management, 6 Read, 2 Tagging, 6 Write; 21 restricted, 21 conditional	*
CodeGuru Reviewer	All 17 actions (see the CodeGuru Reviewer page)	5 List, 6 Read, 2 Tagging, 4 Write; 17 restricted, 17 conditional	*
CodeGuru Security	All 15 actions (see the CodeGuru Security page)	4 List, 5 Read, 2 Tagging, 4 Write; 15 restricted, 15 conditional	*
CodePipeline	All 44 actions (see the CodePipeline page)	3 List, 12 Read, 2 Tagging, 27 Write; 44 restricted, 44 conditional	*
CodeStar Connections	All 38 actions (see the CodeStar Connections page)	7 List, 16 Read, 2 Tagging, 13 Write; 38 restricted, 38 conditional	*
CodeStar Notifications	All 13 actions (see the CodeStar Notifications page)	4 List, 1 Read, 2 Tagging, 6 Write; 13 restricted, 13 conditional	*
CodeWhisperer	All 19 actions (see the CodeWhisperer page)	5 List, 1 Permissions management, 3 Read, 2 Tagging, 8 Write; 19 restricted, 19 conditional	*
Cognito Identity	All 21 actions (see the Cognito Identity page)	2 List, 9 Read, 2 Tagging, 8 Write; 21 restricted, 21 conditional	*
Cognito User Pools	All 139 actions (see the Cognito User Pools page)	18 List, 29 Read, 2 Tagging, 90 Write; 139 restricted, 139 conditional	*
Cognito Sync	All 19 actions (see the Cognito Sync page)	1 List, 9 Read, 9 Write; 19 restricted, 19 conditional	*
Comprehend	All 85 actions (see the Comprehend page)	50 Read, 2 Tagging, 33 Write; 85 restricted, 85 conditional	*
ComprehendMedical	All 25 actions (see the ComprehendMedical page)	15 Read, 10 Write; 25 restricted, 25 conditional	*
Compute Optimizer	All 28 actions (see the Compute Optimizer page)	15 List, 2 Read, 11 Write; 28 restricted, 28 conditional	*
Config	All 102 actions (see the Config page)	18 List, 40 Read, 2 Tagging, 42 Write; 102 restricted, 102 conditional	*
Connect	All 388 actions (see the Connect page)	71 List, 81 Read, 2 Tagging, 234 Write; 388 restricted, 388 conditional	*
Connect Outbound Campaigns	All 40 actions (see the Connect Outbound Campaigns page)	2 List, 7 Read, 2 Tagging, 29 Write; 40 restricted, 40 conditional	*
Console Mobile App	All 2 actions (see the Console Mobile App page)	1 List, 1 Read; 2 restricted, 2 conditional	*
Consolidated Billing	All 2 actions (see the Consolidated Billing page)	1 List, 1 Read; 2 restricted, 2 conditional	*
Continuum	All 33 actions (see the Continuum page)	9 List, 9 Read, 15 Write; 33 restricted, 33 conditional	*
Control Catalog	All 6 actions (see the Control Catalog page)	5 List, 1 Read; 6 restricted, 6 conditional	*
Control Tower	All 65 actions (see the Control Tower page)	17 List, 26 Read, 2 Tagging, 20 Write; 65 restricted, 65 conditional	*
Cost Optimization Hub	All 8 actions (see the Cost Optimization Hub page)	4 List, 2 Read, 2 Write; 8 restricted, 8 conditional	*
Cost and Usage Report	All 12 actions (see the Cost and Usage Report page)	6 Read, 2 Tagging, 4 Write; 12 restricted, 12 conditional	*
Customer Verification Service	All 7 actions (see the Customer Verification Service page)	3 Read, 4 Write; 7 restricted, 7 conditional	*
DataBrew	All 44 actions (see the DataBrew page)	16 Read, 2 Tagging, 26 Write; 44 restricted, 44 conditional	*
Data Exchange	All 39 actions (see the Data Exchange page)	8 List, 7 Read, 2 Tagging, 22 Write; 39 restricted, 39 conditional	*
Data Pipeline	All 21 actions (see the Data Pipeline page)	2 List, 6 Read, 2 Tagging, 11 Write; 21 restricted, 21 conditional	*
DataSync	All 66 actions (see the DataSync page)	8 List, 17 Read, 2 Tagging, 39 Write; 66 restricted, 66 conditional	*
DataZone	All 278 actions (see the DataZone page)	55 List, 6 Permissions management, 62 Read, 2 Tagging, 153 Write; 278 restricted, 278 conditional	*
DynamoDBAccelerator	All 30 actions (see the DynamoDBAccelerator page)	5 List, 7 Read, 2 Tagging, 16 Write; 30 restricted, 30 conditional	*
DBQMS	All 13 actions (see the DBQMS page)	3 List, 1 Read, 9 Write; 13 restricted, 13 conditional	*
Deadline Cloud	All 92 actions (see the Deadline Cloud page)	20 List, 8 Permissions management, 18 Read, 2 Tagging, 44 Write; 92 restricted, 92 conditional	*
Detective	All 36 actions (see the Detective page)	9 List, 11 Read, 2 Tagging, 14 Write; 36 restricted, 36 conditional	*
Device Farm	All 77 actions (see the Device Farm page)	24 List, 18 Read, 2 Tagging, 33 Write; 77 restricted, 77 conditional	*
DevOps Guru	All 31 actions (see the DevOps Guru page)	10 List, 14 Read, 7 Write; 31 restricted, 31 conditional	*
Direct Connect	All 73 actions (see the Direct Connect page)	4 List, 19 Read, 2 Tagging, 48 Write; 73 restricted, 73 conditional	*
Application Discovery	All 29 actions (see the Application Discovery page)	3 List, 9 Read, 2 Tagging, 15 Write; 29 restricted, 29 conditional	*
Data Lifecycle Manager	All 8 actions (see the Data Lifecycle Manager page)	1 List, 2 Read, 2 Tagging, 3 Write; 8 restricted, 8 conditional	*
DMS	All 125 actions (see the DMS page)	51 Read, 2 Tagging, 72 Write; 125 restricted, 125 conditional	*
DocumentDB Elastic Clusters	All 19 actions (see the DocumentDB Elastic Clusters page)	4 List, 3 Read, 2 Tagging, 10 Write; 19 restricted, 19 conditional	*
DRS	All 110 actions (see the DRS page)	35 Read, 2 Tagging, 73 Write; 110 restricted, 110 conditional	*
Directory Service	All 91 actions (see the Directory Service page)	4 List, 1 Permissions management, 25 Read, 2 Tagging, 59 Write; 91 restricted, 91 conditional	*
Directory Service Data	All 17 actions (see the Directory Service Data page)	4 List, 4 Read, 9 Write; 17 restricted, 17 conditional	*
Aurora DSQL	All 30 actions (see the Aurora DSQL page)	2 List, 7 Read, 2 Tagging, 19 Write; 30 restricted, 30 conditional	*
DynamoDB	All 68 actions (see the DynamoDB page)	7 List, 3 Permissions management, 22 Read, 2 Tagging, 34 Write; 68 restricted, 68 conditional	*
Elastic Block Store	All 2 actions (see the Elastic Block Store page)	2 Write; 2 restricted, 2 conditional	*
EC2	All 834 actions (see the EC2 page)	225 List, 23 Permissions management, 63 Read, 2 Tagging, 521 Write; 834 restricted, 834 conditional	*
EC2 Instance Connect	All 3 actions (see the EC2 Instance Connect page)	3 Write; 3 restricted, 3 conditional	*
EC2 Messages	All 6 actions (see the EC2 Messages page)	2 Read, 4 Write; 6 restricted, 6 conditional	*
Elastic Container Registry	All 65 actions (see the Elastic Container Registry page)	5 List, 4 Permissions management, 22 Read, 2 Tagging, 32 Write; 65 restricted, 65 conditional	*
Elastic Container Registry Public	All 23 actions (see the Elastic Container Registry Public page)	3 List, 1 Permissions management, 7 Read, 2 Tagging, 10 Write; 23 restricted, 23 conditional	*
Elastic Container Service	All 92 actions (see the Elastic Container Service page)	15 List, 1 Permissions management, 20 Read, 2 Tagging, 54 Write; 92 restricted, 92 conditional	*
ECS MCP	All 2 actions (see the ECS MCP page)	2 Read; 2 restricted, 2 conditional	*
EKS	All 74 actions (see the EKS page)	14 List, 20 Read, 2 Tagging, 38 Write; 74 restricted, 74 conditional	*
EKS Auth	All 1 actions (see the EKS Auth page)	1 Read; 1 restricted, 1 conditional	*
EKS MCP	All 3 actions (see the EKS MCP page)	2 Read, 1 Write; 3 restricted, 3 conditional	*
ElastiCache	All 77 actions (see the ElastiCache page)	20 List, 1 Read, 2 Tagging, 54 Write; 77 restricted, 77 conditional	*
Elastic Beanstalk	All 50 actions (see the Elastic Beanstalk page)	6 List, 15 Read, 3 Tagging, 26 Write; 50 restricted, 50 conditional	*
EFS	All 38 actions (see the EFS page)	4 List, 2 Permissions management, 9 Read, 4 Tagging, 19 Write; 38 restricted, 38 conditional	*
ELB	All 77 actions (see the ELB page)	2 List, 1 Permissions management, 22 Read, 2 Tagging, 50 Write; 77 restricted, 77 conditional	*
EMR	All 88 actions (see the EMR page)	12 List, 3 Permissions management, 20 Read, 2 Tagging, 51 Write; 88 restricted, 88 conditional	*
Elastic Transcoder	All 17 actions (see the Elastic Transcoder page)	4 List, 3 Read, 10 Write; 17 restricted, 17 conditional	*
Elemental Activations	All 13 actions (see the Elemental Activations page)	7 Read, 6 Write; 13 restricted, 13 conditional	*
Elemental Appliances and Software	All 14 actions (see the Elemental Appliances and Software page)	1 List, 7 Read, 6 Write; 14 restricted, 14 conditional	*
Elemental Inference	All 24 actions (see the Elemental Inference page)	2 List, 7 Read, 2 Tagging, 13 Write; 24 restricted, 24 conditional	*
Elemental Support Cases	All 17 actions (see the Elemental Support Cases page)	5 Read, 2 Tagging, 10 Write; 17 restricted, 17 conditional	*
Elemental Support Content	All 1 actions (see the Elemental Support Content page)	1 Read; 1 restricted, 1 conditional	*
EMR Containers	All 25 actions (see the EMR Containers page)	6 List, 5 Read, 2 Tagging, 12 Write; 25 restricted, 25 conditional	*
EMR Serverless	All 25 actions (see the EMR Serverless page)	4 List, 7 Read, 2 Tagging, 12 Write; 25 restricted, 25 conditional	*
End User Messaging	All 27 actions (see the End User Messaging page)	5 List, 5 Read, 2 Tagging, 15 Write; 27 restricted, 27 conditional	*
Entity Resolution	All 40 actions (see the Entity Resolution page)	7 List, 5 Permissions management, 10 Read, 2 Tagging, 16 Write; 40 restricted, 40 conditional	*
OpenSearch Service	All 138 actions (see the OpenSearch Service page)	34 List, 29 Read, 2 Tagging, 73 Write; 138 restricted, 138 conditional	*
EventBridge	All 71 actions (see the EventBridge page)	15 List, 4 Permissions management, 12 Read, 2 Tagging, 38 Write; 71 restricted, 71 conditional	*
eventsbilltoaws	All 2 actions (see the eventsbilltoaws page)	1 Read, 1 Write; 2 restricted, 2 conditional	*
EVS	All 24 actions (see the EVS page)	5 List, 5 Read, 2 Tagging, 12 Write; 24 restricted, 24 conditional	*
ExecuteAPI	All 3 actions (see the ExecuteAPI page)	3 Write; 3 restricted, 3 conditional	*
FinOps Agent	All 46 actions (see the FinOps Agent page)	10 List, 11 Read, 25 Write; 46 restricted, 46 conditional	*
FinSpace	All 59 actions (see the FinSpace page)	12 List, 12 Read, 2 Tagging, 33 Write; 59 restricted, 59 conditional	*
FinSpace API	All 1 actions (see the FinSpace API page)	1 Read; 1 restricted, 1 conditional	*
Firehose	All 10 actions (see the Firehose page)	2 List, 1 Read, 2 Tagging, 5 Write; 10 restricted, 10 conditional	*
FIS	All 29 actions (see the FIS page)	7 List, 8 Read, 2 Tagging, 12 Write; 29 restricted, 29 conditional	*
Firewall Manager	All 42 actions (see the Firewall Manager page)	11 List, 12 Read, 2 Tagging, 17 Write; 42 restricted, 42 conditional	*
Forecast	All 70 actions (see the Forecast page)	35 Read, 2 Tagging, 33 Write; 70 restricted, 70 conditional	*
Fraud Detector	All 74 actions (see the Fraud Detector page)	14 List, 12 Read, 2 Tagging, 46 Write; 74 restricted, 74 conditional	*
FreeRTOS	All 20 actions (see the FreeRTOS page)	7 List, 7 Read, 6 Write; 20 restricted, 20 conditional	*
Free Tier	All 7 actions (see the Free Tier page)	1 List, 4 Read, 2 Write; 7 restricted, 7 conditional	*
FSx	All 56 actions (see the FSx page)	5 Permissions management, 13 Read, 2 Tagging, 36 Write; 56 restricted, 56 conditional	*
GameLift Servers	All 121 actions (see the GameLift Servers page)	12 List, 1 Permissions management, 43 Read, 2 Tagging, 63 Write; 121 restricted, 121 conditional	*
GameLift Streams	All 18 actions (see the GameLift Streams page)	3 List, 3 Read, 2 Tagging, 10 Write; 18 restricted, 18 conditional	*
Location	All 64 actions (see the Location page)	7 List, 27 Read, 2 Tagging, 28 Write; 64 restricted, 64 conditional	*
Glacier	All 33 actions (see the Glacier page)	6 List, 6 Permissions management, 7 Read, 2 Tagging, 12 Write; 33 restricted, 33 conditional	*
GlobalAccelerator	All 56 actions (see the GlobalAccelerator page)	12 List, 10 Read, 2 Tagging, 32 Write; 56 restricted, 56 conditional	*
Glue	All 306 actions (see the Glue page)	27 List, 36 Permissions management, 93 Read, 2 Tagging, 148 Write; 306 restricted, 306 conditional	*
Managed Grafana	All 25 actions (see the Managed Grafana page)	2 List, 1 Permissions management, 7 Read, 2 Tagging, 13 Write; 25 restricted, 25 conditional	*
IoT Greengrass	All 112 actions (see the IoT Greengrass page)	26 List, 1 Permissions management, 32 Read, 2 Tagging, 51 Write; 112 restricted, 112 conditional	*
Ground Station	All 40 actions (see the Ground Station page)	10 List, 11 Read, 2 Tagging, 17 Write; 40 restricted, 40 conditional	*
GroundTruth Labeling	All 16 actions (see the GroundTruth Labeling page)	6 Read, 10 Write; 16 restricted, 16 conditional	*
GuardDuty	All 103 actions (see the GuardDuty page)	18 List, 29 Read, 2 Tagging, 54 Write; 103 restricted, 103 conditional	*
Health	All 14 actions (see the Health page)	2 Permissions management, 12 Read; 14 restricted, 14 conditional	*
Connect Health	All 45 actions (see the Connect Health page)	6 List, 16 Read, 2 Tagging, 21 Write; 45 restricted, 45 conditional	*
HealthLake	All 68 actions (see the HealthLake page)	7 List, 27 Read, 2 Tagging, 32 Write; 68 restricted, 68 conditional	*
Honeycode	All 30 actions (see the Honeycode page)	7 List, 4 Read, 3 Tagging, 16 Write; 30 restricted, 30 conditional	*
IAM	All 190 actions (see the IAM page)	40 List, 23 Permissions management, 37 Read, 16 Tagging, 74 Write; 190 restricted, 190 conditional	*
Identity Sync	All 13 actions (see the Identity Sync page)	1 List, 1 Permissions management, 2 Read, 9 Write; 13 restricted, 13 conditional	*
Identity Store	All 29 actions (see the Identity Store page)	6 List, 9 Read, 14 Write; 29 restricted, 29 conditional	*
Identity Store Auth	All 3 actions (see the Identity Store Auth page)	1 List, 1 Read, 1 Write; 3 restricted, 3 conditional	*
EC2 Image Builder	All 77 actions (see the EC2 Image Builder page)	21 List, 4 Permissions management, 18 Read, 2 Tagging, 32 Write; 77 restricted, 77 conditional	*
Import/Export	All 6 actions (see the Import/Export page)	1 List, 2 Read, 3 Write; 6 restricted, 6 conditional	*
Inspector	All 37 actions (see the Inspector page)	8 List, 13 Read, 1 Tagging, 15 Write; 37 restricted, 37 conditional	*
InspectorScan	All 1 actions (see the InspectorScan page)	1 Read; 1 restricted, 1 conditional	*
Inspector2	All 84 actions (see the Inspector2 page)	20 List, 21 Read, 2 Tagging, 41 Write; 84 restricted, 84 conditional	*
Inspector2Telemtry	All 5 actions (see the Inspector2Telemtry page)	5 Write; 5 restricted, 5 conditional	*
Interconnect	All 13 actions (see the Interconnect page)	2 List, 5 Read, 2 Tagging, 4 Write; 13 restricted, 13 conditional	*
Internet Monitor	All 17 actions (see the Internet Monitor page)	3 List, 8 Read, 2 Tagging, 4 Write; 17 restricted, 17 conditional	*
Invoicing Service	All 26 actions (see the Invoicing Service page)	5 List, 8 Read, 2 Tagging, 11 Write; 26 restricted, 26 conditional	*
IoT	All 293 actions (see the IoT page)	68 List, 10 Permissions management, 64 Read, 2 Tagging, 149 Write; 293 restricted, 293 conditional	*
IoT Device Tester	All 5 actions (see the IoT Device Tester page)	4 Read, 1 Write; 5 restricted, 5 conditional	*
IoT Analytics	All 34 actions (see the IoT Analytics page)	5 List, 9 Read, 2 Tagging, 18 Write; 34 restricted, 34 conditional	*
IoT Device Advisor	All 14 actions (see the IoT Device Advisor page)	2 List, 5 Read, 2 Tagging, 5 Write; 14 restricted, 14 conditional	*
IoT Fleet Hub	All 8 actions (see the IoT Fleet Hub page)	1 List, 2 Read, 2 Tagging, 3 Write; 8 restricted, 8 conditional	*
IoT FleetWise	All 56 actions (see the IoT FleetWise page)	3 List, 1 Permissions management, 22 Read, 2 Tagging, 28 Write; 56 restricted, 56 conditional	*
IoT Jobs DataPlane	All 4 actions (see the IoT Jobs DataPlane page)	2 Read, 2 Write; 4 restricted, 4 conditional	*
IoT Managed Integrations	All 83 actions (see the IoT Managed Integrations page)	11 List, 29 Read, 2 Tagging, 41 Write; 83 restricted, 83 conditional	*
IoT SiteWise	All 129 actions (see the IoT SiteWise page)	32 List, 31 Read, 2 Tagging, 64 Write; 129 restricted, 129 conditional	*
IoT TwinMaker	All 37 actions (see the IoT TwinMaker page)	10 List, 8 Read, 2 Tagging, 17 Write; 37 restricted, 37 conditional	*
IoT Wireless	All 113 actions (see the IoT Wireless page)	45 Read, 2 Tagging, 66 Write; 113 restricted, 113 conditional	*
IQ	All 63 actions (see the IQ page)	1 List, 23 Read, 39 Write; 63 restricted, 63 conditional	*
IQ Permission	All 9 actions (see the IQ Permission page)	2 Read, 7 Write; 9 restricted, 9 conditional	*
Interactive Video Service	All 83 actions (see the Interactive Video Service page)	19 List, 20 Read, 2 Tagging, 42 Write; 83 restricted, 83 conditional	*
Interactive Video Service Chat	All 17 actions (see the Interactive Video Service Chat page)	2 List, 3 Read, 2 Tagging, 10 Write; 17 restricted, 17 conditional	*
MSK	All 64 actions (see the MSK page)	15 List, 14 Read, 2 Tagging, 33 Write; 64 restricted, 64 conditional	*
Apache Kafka APIs for MSK	All 19 actions (see the Apache Kafka APIs for MSK page)	6 List, 1 Read, 12 Write; 19 restricted, 19 conditional	*
MSK Connect	All 21 actions (see the MSK Connect page)	9 Read, 2 Tagging, 10 Write; 21 restricted, 21 conditional	*
Kendra	All 66 actions (see the Kendra page)	12 List, 16 Read, 2 Tagging, 36 Write; 66 restricted, 66 conditional	*
Kendra Intelligent Ranking	All 8 actions (see the Kendra Intelligent Ranking page)	1 List, 2 Read, 2 Tagging, 3 Write; 8 restricted, 8 conditional	*
Kinesis	All 42 actions (see the Kinesis page)	4 List, 9 Read, 5 Tagging, 24 Write; 42 restricted, 42 conditional	*
Kinesis Analytics	All 34 actions (see the Kinesis Analytics page)	1 List, 11 Read, 2 Tagging, 20 Write; 34 restricted, 34 conditional	*
Kinesis Video Streams	All 37 actions (see the Kinesis Video Streams page)	6 List, 10 Read, 4 Tagging, 17 Write; 37 restricted, 37 conditional	*
KMS	All 58 actions (see the KMS page)	7 List, 4 Permissions management, 7 Read, 2 Tagging, 38 Write; 58 restricted, 58 conditional	*
Lake Formation	All 68 actions (see the Lake Formation page)	8 List, 7 Permissions management, 21 Read, 2 Tagging, 30 Write; 68 restricted, 68 conditional	*
Lambda	All 121 actions (see the Lambda page)	25 List, 8 Permissions management, 31 Read, 2 Tagging, 55 Write; 121 restricted, 121 conditional	*
Launch Wizard	All 40 actions (see the Launch Wizard page)	11 List, 16 Read, 2 Tagging, 11 Write; 40 restricted, 40 conditional	*
Lex	All 146 actions (see the Lex page)	39 List, 37 Read, 2 Tagging, 68 Write; 146 restricted, 146 conditional	*
License Manager	All 62 actions (see the License Manager page)	20 List, 1 Permissions management, 11 Read, 2 Tagging, 28 Write; 62 restricted, 62 conditional	*
License Manager Linux Subscriptions	All 11 actions (see the License Manager Linux Subscriptions page)	6 Read, 2 Tagging, 3 Write; 11 restricted, 11 conditional	*
License Manager User Subscriptions	All 17 actions (see the License Manager User Subscriptions page)	5 List, 1 Read, 2 Tagging, 9 Write; 17 restricted, 17 conditional	*
Lightsail	All 161 actions (see the Lightsail page)	64 Read, 2 Tagging, 95 Write; 161 restricted, 161 conditional	*
CloudWatch Logs	All 133 actions (see the CloudWatch Logs page)	33 List, 2 Permissions management, 26 Read, 4 Tagging, 68 Write; 133 restricted, 133 conditional	*
Lookout for Equipment	All 49 actions (see the Lookout for Equipment page)	9 List, 12 Read, 2 Tagging, 26 Write; 49 restricted, 49 conditional	*
Lookout Metrics	All 30 actions (see the Lookout Metrics page)	6 List, 9 Read, 2 Tagging, 13 Write; 30 restricted, 30 conditional	*
Lookout Vision	All 25 actions (see the Lookout Vision page)	4 List, 7 Read, 2 Tagging, 12 Write; 25 restricted, 25 conditional	*
Mainframe Modernization	All 37 actions (see the Mainframe Modernization page)	2 List, 19 Read, 2 Tagging, 14 Write; 37 restricted, 37 conditional	*
Machine Learning	All 27 actions (see the Machine Learning page)	5 List, 4 Read, 2 Tagging, 16 Write; 27 restricted, 27 conditional	*
Macie	All 81 actions (see the Macie page)	14 List, 28 Read, 2 Tagging, 37 Write; 81 restricted, 81 conditional	*
Managed Blockchain	All 34 actions (see the Managed Blockchain page)	6 List, 3 Permissions management, 11 Read, 2 Tagging, 12 Write; 34 restricted, 34 conditional	*
MapCredits	All 3 actions (see the MapCredits page)	3 List; 3 restricted, 3 conditional	*
CAS	All 2 actions (see the CAS page)	2 Write; 2 restricted, 2 conditional	*
MechanicalTurk	All 39 actions (see the MechanicalTurk page)	10 List, 6 Read, 23 Write; 39 restricted, 39 conditional	*
MediaConnect	All 95 actions (see the MediaConnect page)	12 List, 5 Permissions management, 18 Read, 2 Tagging, 58 Write; 95 restricted, 95 conditional	*
MediaConvert	All 32 actions (see the MediaConvert page)	7 List, 7 Read, 2 Tagging, 16 Write; 32 restricted, 32 conditional	*
mediaimport	All 1 actions (see the mediaimport page)	1 Write; 1 restricted, 1 conditional	*
MediaLive	All 125 actions (see the MediaLive page)	24 List, 22 Read, 2 Tagging, 77 Write; 125 restricted, 125 conditional	*
MediaPackage	All 19 actions (see the MediaPackage page)	7 Read, 2 Tagging, 10 Write; 19 restricted, 19 conditional	*
MediaPackage VOD	All 17 actions (see the MediaPackage VOD page)	3 List, 4 Read, 2 Tagging, 8 Write; 17 restricted, 17 conditional	*
MediaPackage v2	All 34 actions (see the MediaPackage v2 page)	4 List, 10 Read, 2 Tagging, 18 Write; 34 restricted, 34 conditional	*
MediaStore	All 26 actions (see the MediaStore page)	4 List, 2 Permissions management, 6 Read, 2 Tagging, 12 Write; 26 restricted, 26 conditional	*
MediaTailor	All 44 actions (see the MediaTailor page)	2 List, 2 Permissions management, 15 Read, 2 Tagging, 23 Write; 44 restricted, 44 conditional	*
HealthImaging	All 27 actions (see the HealthImaging page)	4 List, 13 Read, 2 Tagging, 8 Write; 27 restricted, 27 conditional	*
MemoryDB	All 47 actions (see the MemoryDB page)	18 Read, 2 Tagging, 27 Write; 47 restricted, 47 conditional	*
Migration Hub	All 46 actions (see the Migration Hub page)	13 List, 6 Read, 2 Tagging, 25 Write; 46 restricted, 46 conditional	*
MGN	All 147 actions (see the MGN page)	34 List, 20 Read, 2 Tagging, 91 Write; 147 restricted, 147 conditional	*
MigrationHubOrchestrator	All 34 actions (see the MigrationHubOrchestrator page)	7 List, 8 Read, 2 Tagging, 17 Write; 34 restricted, 34 conditional	*
Migration Hub Strategy Recommendations	All 31 actions (see the Migration Hub Strategy Recommendations page)	7 List, 12 Read, 12 Write; 31 restricted, 31 conditional	*
Mobile Analytics	All 3 actions (see the Mobile Analytics page)	2 Read, 1 Write; 3 restricted, 3 conditional	*
Pinpoint	All 119 actions (see the Pinpoint page)	16 List, 39 Read, 2 Tagging, 62 Write; 119 restricted, 119 conditional	*
Monitron	All 18 actions (see the Monitron page)	3 List, 7 Permissions management, 3 Read, 2 Tagging, 3 Write; 18 restricted, 18 conditional	*
Multi-party approval	All 25 actions (see the Multi-party approval page)	7 List, 2 Permissions management, 5 Read, 2 Tagging, 9 Write; 25 restricted, 25 conditional	*
MQ	All 27 actions (see the MQ page)	5 List, 7 Read, 2 Tagging, 13 Write; 27 restricted, 27 conditional	*
Neptune	All 33 actions (see the Neptune page)	5 List, 11 Read, 17 Write; 33 restricted, 33 conditional	*
Neptune Analytics	All 38 actions (see the Neptune Analytics page)	17 Read, 2 Tagging, 19 Write; 38 restricted, 38 conditional	*
Network Firewall	All 89 actions (see the Network Firewall page)	13 List, 19 Read, 2 Tagging, 55 Write; 89 restricted, 89 conditional	*
Network Security Director	All 8 actions (see the Network Security Director page)	5 List, 2 Read, 1 Write; 8 restricted, 8 conditional	*
Network Security Manager	All 46 actions (see the Network Security Manager page)	6 List, 15 Read, 2 Tagging, 23 Write; 46 restricted, 46 conditional	*
Network Flow Monitor	All 14 actions (see the Network Flow Monitor page)	2 List, 3 Read, 2 Tagging, 7 Write; 14 restricted, 14 conditional	*
Network Manager	All 97 actions (see the Network Manager page)	19 List, 3 Permissions management, 20 Read, 2 Tagging, 53 Write; 97 restricted, 97 conditional	*
Network Manager Chat	All 7 actions (see the Network Manager Chat page)	2 List, 5 Write; 7 restricted, 7 conditional	*
Network Synthetic Monitor	All 12 actions (see the Network Synthetic Monitor page)	1 List, 3 Read, 2 Tagging, 6 Write; 12 restricted, 12 conditional	*
Nimble Studio	All 51 actions (see the Nimble Studio page)	24 Read, 2 Tagging, 25 Write; 51 restricted, 51 conditional	*
User Notifications	All 44 actions (see the User Notifications page)	12 List, 2 Permissions management, 9 Read, 2 Tagging, 19 Write; 44 restricted, 44 conditional	*
User Notifications Contacts	All 9 actions (see the User Notifications Contacts page)	1 List, 2 Read, 2 Tagging, 4 Write; 9 restricted, 9 conditional	*
Nova Act	All 12 actions (see the Nova Act page)	2 List, 5 Read, 5 Write; 12 restricted, 12 conditional	*
OAM	All 15 actions (see the OAM page)	7 Read, 2 Tagging, 6 Write; 15 restricted, 15 conditional	*
CloudWatch Observability Admin	All 45 actions (see the CloudWatch Observability Admin page)	7 List, 13 Read, 2 Tagging, 23 Write; 45 restricted, 45 conditional	*
Oracle Database@AWS	All 96 actions (see the Oracle Database@AWS page)	21 List, 16 Read, 2 Tagging, 57 Write; 96 restricted, 96 conditional	*
Omics	All 108 actions (see the Omics page)	26 List, 2 Permissions management, 25 Read, 2 Tagging, 53 Write; 108 restricted, 108 conditional	*
One	All 28 actions (see the One page)	5 List, 6 Read, 2 Tagging, 15 Write; 28 restricted, 28 conditional	*
OpenSearch	All 11 actions (see the OpenSearch page)	1 List, 2 Permissions management, 3 Read, 5 Write; 11 restricted, 11 conditional	*
OpsWorks	All 74 actions (see the OpsWorks page)	23 List, 2 Permissions management, 1 Read, 2 Tagging, 46 Write; 74 restricted, 74 conditional	*
OpsworksCM	All 19 actions (see the OpsworksCM page)	5 List, 2 Read, 2 Tagging, 10 Write; 19 restricted, 19 conditional	*
Organizations	All 63 actions (see the Organizations page)	20 List, 5 Permissions management, 9 Read, 2 Tagging, 27 Write; 63 restricted, 63 conditional	*
OpenSearch Ingestion	All 23 actions (see the OpenSearch Ingestion page)	4 List, 6 Read, 2 Tagging, 11 Write; 23 restricted, 23 conditional	*
Outposts	All 44 actions (see the Outposts page)	10 List, 14 Read, 2 Tagging, 18 Write; 44 restricted, 44 conditional	*
Panorama	All 36 actions (see the Panorama page)	9 List, 12 Read, 2 Tagging, 13 Write; 36 restricted, 36 conditional	*
Partner Central	All 164 actions (see the Partner Central page)	36 List, 45 Read, 2 Tagging, 81 Write; 164 restricted, 164 conditional	*
Partner central account management	All 6 actions (see the Partner central account management page)	6 Write; 6 restricted, 6 conditional	*
Payment Cryptography	All 47 actions (see the Payment Cryptography page)	2 List, 2 Permissions management, 10 Read, 2 Tagging, 31 Write; 47 restricted, 47 conditional	*
Payments	All 28 actions (see the Payments page)	10 List, 6 Read, 2 Tagging, 10 Write; 28 restricted, 28 conditional	*
Private CA Connector for Active Directory	All 25 actions (see the Private CA Connector for Active Directory page)	5 List, 6 Read, 2 Tagging, 12 Write; 25 restricted, 25 conditional	*
Private CA Connector for SCEP	All 12 actions (see the Private CA Connector for SCEP page)	2 List, 4 Read, 2 Tagging, 4 Write; 12 restricted, 12 conditional	*
Parallel Computing Service	All 20 actions (see the Parallel Computing Service page)	3 List, 4 Read, 2 Tagging, 11 Write; 20 restricted, 20 conditional	*
Personalize	All 83 actions (see the Personalize page)	19 List, 24 Read, 2 Tagging, 38 Write; 83 restricted, 83 conditional	*
Performance Insights	All 14 actions (see the Performance Insights page)	3 List, 7 Read, 2 Tagging, 2 Write; 14 restricted, 14 conditional	*
EventBridge Pipes	All 10 actions (see the EventBridge Pipes page)	1 List, 2 Read, 2 Tagging, 5 Write; 10 restricted, 10 conditional	*
Polly	All 13 actions (see the Polly page)	3 List, 5 Read, 2 Tagging, 3 Write; 13 restricted, 13 conditional	*
Price List	All 5 actions (see the Price List page)	5 Read; 5 restricted, 5 conditional	*
PricingPlanManager	All 9 actions (see the PricingPlanManager page)	2 Read, 7 Write; 9 restricted, 9 conditional	*
Private 5G	All 26 actions (see the Private 5G page)	6 List, 6 Read, 2 Tagging, 12 Write; 26 restricted, 26 conditional	*
Profile	All 117 actions (see the Profile page)	28 List, 36 Read, 2 Tagging, 51 Write; 117 restricted, 117 conditional	*
Proton	All 111 actions (see the Proton page)	24 List, 26 Read, 2 Tagging, 59 Write; 111 restricted, 111 conditional	*
Purchase Orders	All 14 actions (see the Purchase Orders page)	2 List, 4 Read, 2 Tagging, 6 Write; 14 restricted, 14 conditional	*
Q	All 54 actions (see the Q page)	8 List, 14 Read, 2 Tagging, 30 Write; 54 restricted, 54 conditional	*
Q Apps	All 21 actions (see the Q Apps page)	2 List, 3 Read, 2 Tagging, 14 Write; 21 restricted, 21 conditional	*
Q Business	All 67 actions (see the Q Business page)	11 List, 1 Permissions management, 14 Read, 2 Tagging, 39 Write; 67 restricted, 67 conditional	*
Q Developer	All 7 actions (see the Q Developer page)	1 List, 2 Tagging, 4 Write; 7 restricted, 7 conditional	*
QLDB	All 35 actions (see the QLDB page)	4 List, 9 Read, 2 Tagging, 20 Write; 35 restricted, 35 conditional	*
QuickSight	All 357 actions (see the QuickSight page)	68 List, 19 Permissions management, 91 Read, 2 Tagging, 177 Write; 357 restricted, 357 conditional	*
Resource Access Manager	All 39 actions (see the Resource Access Manager page)	9 List, 3 Permissions management, 7 Read, 2 Tagging, 18 Write; 39 restricted, 39 conditional	*
Recycle Bin	All 10 actions (see the Recycle Bin page)	3 Read, 2 Tagging, 5 Write; 10 restricted, 10 conditional	*
RDS	All 173 actions (see the RDS page)	47 List, 1 Permissions management, 5 Read, 2 Tagging, 118 Write; 173 restricted, 173 conditional	*
RDS IAM Authentication	All 1 actions (see the RDS IAM Authentication page)	1 Permissions management; 1 restricted, 1 conditional	*
Redshift	All 167 actions (see the Redshift page)	18 List, 13 Permissions management, 40 Read, 2 Tagging, 94 Write; 167 restricted, 167 conditional	*
Redshift Data API	All 12 actions (see the Redshift Data API page)	3 List, 6 Read, 3 Write; 12 restricted, 12 conditional	*
Redshift Serverless	All 69 actions (see the Redshift Serverless page)	15 List, 17 Read, 2 Tagging, 35 Write; 69 restricted, 69 conditional	*
Migration Hub Refactor Spaces	All 24 actions (see the Migration Hub Refactor Spaces page)	11 Read, 2 Tagging, 11 Write; 24 restricted, 24 conditional	*
Rekognition	All 76 actions (see the Rekognition page)	1 List, 36 Read, 2 Tagging, 37 Write; 76 restricted, 76 conditional	*
re:Post Private	All 19 actions (see the re:Post Private page)	5 Read, 2 Tagging, 12 Write; 19 restricted, 19 conditional	*
Bio Discovery	All 6 actions (see the Bio Discovery page)	1 List, 1 Read, 4 Write; 6 restricted, 6 conditional	*
Resilience Hub	All 133 actions (see the Resilience Hub page)	20 List, 46 Read, 2 Tagging, 65 Write; 133 restricted, 133 conditional	*
Tag Editor	All 3 actions (see the Tag Editor page)	2 List, 1 Read; 3 restricted, 3 conditional	*
Resource Explorer	All 37 actions (see the Resource Explorer page)	8 List, 2 Permissions management, 12 Read, 2 Tagging, 13 Write; 37 restricted, 37 conditional	*
Resource Groups	All 29 actions (see the Resource Groups page)	6 List, 7 Read, 2 Tagging, 14 Write; 29 restricted, 29 conditional	*
RHEL KB	All 1 actions (see the RHEL KB page)	1 Read; 1 restricted, 1 conditional	*
RoboMaker	All 59 actions (see the RoboMaker page)	13 List, 13 Read, 2 Tagging, 31 Write; 59 restricted, 59 conditional	*
IAM Roles Anywhere	All 30 actions (see the IAM Roles Anywhere page)	5 List, 4 Read, 2 Tagging, 19 Write; 30 restricted, 30 conditional	*
Route 53	All 71 actions (see the Route 53 page)	22 List, 16 Read, 1 Tagging, 32 Write; 71 restricted, 71 conditional	*
Route 53 Recovery Cluster	All 4 actions (see the Route 53 Recovery Cluster page)	2 Read, 2 Write; 4 restricted, 4 conditional	*
Route 53 Recovery Controls	All 27 actions (see the Route 53 Recovery Controls page)	1 List, 2 Permissions management, 10 Read, 2 Tagging, 12 Write; 27 restricted, 27 conditional	*
Route 53 Recovery Readiness	All 32 actions (see the Route 53 Recovery Readiness page)	16 Read, 2 Tagging, 14 Write; 32 restricted, 32 conditional	*
Route 53 Domains	All 36 actions (see the Route 53 Domains page)	3 List, 9 Read, 2 Tagging, 22 Write; 36 restricted, 36 conditional	*
Route 53 Global Resolver	All 48 actions (see the Route 53 Global Resolver page)	8 List, 1 Permissions management, 9 Read, 2 Tagging, 28 Write; 48 restricted, 48 conditional	*
Route 53 Profiles	All 19 actions (see the Route 53 Profiles page)	4 List, 4 Read, 2 Tagging, 9 Write; 19 restricted, 19 conditional	*
Route 53 Resolver	All 70 actions (see the Route 53 Resolver page)	16 List, 3 Permissions management, 16 Read, 2 Tagging, 33 Write; 70 restricted, 70 conditional	*
RTB Fabric	All 36 actions (see the RTB Fabric page)	5 List, 8 Read, 2 Tagging, 21 Write; 36 restricted, 36 conditional	*
CloudWatch RUM	All 19 actions (see the CloudWatch RUM page)	1 List, 6 Read, 2 Tagging, 10 Write; 19 restricted, 19 conditional	*
S3	All 155 actions (see the S3 page)	15 List, 24 Permissions management, 58 Read, 8 Tagging, 50 Write; 155 restricted, 155 conditional	*
S3 Object Lambda	All 26 actions (see the S3 Object Lambda page)	4 List, 2 Permissions management, 8 Read, 4 Tagging, 8 Write; 26 restricted, 26 conditional	*
S3 Outposts	All 48 actions (see the S3 Outposts page)	9 List, 5 Permissions management, 13 Read, 6 Tagging, 15 Write; 48 restricted, 48 conditional	*
S3 Express	All 28 actions (see the S3 Express page)	3 List, 6 Permissions management, 8 Read, 2 Tagging, 9 Write; 28 restricted, 28 conditional	*
S3 Files	All 24 actions (see the S3 Files page)	3 List, 2 Permissions management, 7 Read, 2 Tagging, 10 Write; 24 restricted, 24 conditional	*
S3 Tables	All 61 actions (see the S3 Tables page)	5 List, 4 Permissions management, 22 Read, 2 Tagging, 28 Write; 61 restricted, 61 conditional	*
S3 Vectors	All 21 actions (see the S3 Vectors page)	4 List, 2 Permissions management, 5 Read, 2 Tagging, 8 Write; 21 restricted, 21 conditional	*
SageMaker	All 441 actions (see the SageMaker page)	96 List, 97 Read, 2 Tagging, 246 Write; 441 restricted, 441 conditional	*
SageMakerDataScienceAssistant	All 1 actions (see the SageMakerDataScienceAssistant page)	1 Write; 1 restricted, 1 conditional	*
SageMaker geospatial capabilities	All 19 actions (see the SageMaker geospatial capabilities page)	4 List, 5 Read, 2 Tagging, 8 Write; 19 restricted, 19 conditional	*
SageMaker MLflow	All 61 actions (see the SageMaker MLflow page)	3 List, 17 Read, 41 Write; 61 restricted, 61 conditional	*
SageMaker Unified Studio MCP	All 1 actions (see the SageMaker Unified Studio MCP page)	1 Read; 1 restricted, 1 conditional	*
Savings Plans	All 10 actions (see the Savings Plans page)	1 List, 4 Read, 2 Tagging, 3 Write; 10 restricted, 10 conditional	*
EventBridge Scheduler	All 13 actions (see the EventBridge Scheduler page)	3 List, 3 Read, 2 Tagging, 5 Write; 13 restricted, 13 conditional	*
EventBridge Schemas	All 31 actions (see the EventBridge Schemas page)	5 List, 9 Read, 2 Tagging, 15 Write; 31 restricted, 31 conditional	*
ASC	All 31 actions (see the ASC page)	6 List, 6 Read, 2 Tagging, 17 Write; 31 restricted, 31 conditional	*
SimpleDB	All 13 actions (see the SimpleDB page)	2 List, 4 Read, 7 Write; 13 restricted, 13 conditional	*
Secrets Manager	All 27 actions (see the Secrets Manager page)	1 List, 3 Permissions management, 7 Read, 2 Tagging, 14 Write; 27 restricted, 27 conditional	*
Security Incident Response	All 25 actions (see the Security Incident Response page)	2 List, 9 Read, 2 Tagging, 12 Write; 25 restricted, 25 conditional	*
securityagent	All 119 actions (see the securityagent page)	27 List, 28 Read, 2 Tagging, 62 Write; 119 restricted, 119 conditional	*
SecurityHub	All 141 actions (see the SecurityHub page)	20 List, 1 Permissions management, 52 Read, 2 Tagging, 66 Write; 141 restricted, 141 conditional	*
SecurityLake	All 31 actions (see the SecurityLake page)	5 List, 4 Read, 2 Tagging, 20 Write; 31 restricted, 31 conditional	*
Serverless Application Repository	All 15 actions (see the Serverless Application Repository page)	3 List, 4 Read, 8 Write; 15 restricted, 15 conditional	*
Service Catalog	All 117 actions (see the Service Catalog page)	28 List, 3 Permissions management, 23 Read, 2 Tagging, 61 Write; 117 restricted, 117 conditional	*
Cloud Map	All 31 actions (see the Cloud Map page)	1 List, 11 Read, 2 Tagging, 17 Write; 31 restricted, 31 conditional	*
Microservice Extractor for .NET	All 1 actions (see the Microservice Extractor for .NET page)	1 Read; 1 restricted, 1 conditional	*
Service Quotas	All 26 actions (see the Service Quotas page)	15 Read, 2 Tagging, 9 Write; 26 restricted, 26 conditional	*
SES	All 231 actions (see the SES page)	31 List, 8 Permissions management, 61 Read, 2 Tagging, 129 Write; 231 restricted, 231 conditional	*
Shield	All 40 actions (see the Shield page)	5 List, 11 Read, 2 Tagging, 22 Write; 40 restricted, 40 conditional	*
Signer	All 18 actions (see the Signer page)	3 List, 2 Permissions management, 5 Read, 2 Tagging, 6 Write; 18 restricted, 18 conditional	*
Signin	All 17 actions (see the Signin page)	2 List, 7 Read, 8 Write; 17 restricted, 17 conditional	*
SimSpace Weaver	All 16 actions (see the SimSpace Weaver page)	1 List, 4 Read, 2 Tagging, 9 Write; 16 restricted, 16 conditional	*
ServerMigrationService	All 37 actions (see the ServerMigrationService page)	1 List, 10 Read, 26 Write; 37 restricted, 37 conditional	*
Pinpoint SMS Voice	All 107 actions (see the Pinpoint SMS Voice page)	2 Permissions management, 33 Read, 2 Tagging, 70 Write; 107 restricted, 107 conditional	*
Snow Device Management	All 13 actions (see the Snow Device Management page)	4 List, 5 Read, 2 Tagging, 2 Write; 13 restricted, 13 conditional	*
Snowball	All 27 actions (see the Snowball page)	7 List, 9 Read, 11 Write; 27 restricted, 27 conditional	*
SNS	All 40 actions (see the SNS page)	7 List, 3 Permissions management, 10 Read, 2 Tagging, 18 Write; 40 restricted, 40 conditional	*
Social Messaging	All 32 actions (see the Social Messaging page)	5 List, 8 Read, 2 Tagging, 17 Write; 32 restricted, 32 conditional	*
SQL Workbench	All 79 actions (see the SQL Workbench page)	9 List, 23 Read, 2 Tagging, 45 Write; 79 restricted, 79 conditional	*
SQS	All 20 actions (see the SQS page)	3 Permissions management, 7 Read, 2 Tagging, 8 Write; 20 restricted, 20 conditional	*
Systems Manager	All 164 actions (see the Systems Manager page)	35 List, 3 Permissions management, 51 Read, 2 Tagging, 73 Write; 164 restricted, 164 conditional	*
Incident Manager Contacts	All 40 actions (see the Incident Manager Contacts page)	11 List, 1 Permissions management, 8 Read, 2 Tagging, 18 Write; 40 restricted, 40 conditional	*
GUI Connect	All 7 actions (see the GUI Connect page)	1 List, 2 Read, 4 Write; 7 restricted, 7 conditional	*
Incident Manager	All 31 actions (see the Incident Manager page)	6 List, 2 Permissions management, 7 Read, 2 Tagging, 14 Write; 31 restricted, 31 conditional	*
Systems Manager Quick Setup	All 14 actions (see the Systems Manager Quick Setup page)	2 List, 5 Read, 2 Tagging, 5 Write; 14 restricted, 14 conditional	*
Systems Manager for SAP	All 30 actions (see the Systems Manager for SAP page)	9 List, 3 Permissions management, 6 Read, 2 Tagging, 10 Write; 30 restricted, 30 conditional	*
SSM Messages	All 4 actions (see the SSM Messages page)	4 Write; 4 restricted, 4 conditional	*
IAM Identity Center	All 126 actions (see the IAM Identity Center page)	23 List, 8 Permissions management, 35 Read, 2 Tagging, 58 Write; 126 restricted, 126 conditional	*
IAM Identity Center directory	All 57 actions (see the IAM Identity Center directory page)	25 Read, 32 Write; 57 restricted, 57 conditional	*
OIDC service	All 3 actions (see the OIDC service page)	3 Write; 3 restricted, 3 conditional	*
Startups	All 1 actions (see the Startups page)	1 Read; 1 restricted, 1 conditional	*
Step Functions	All 37 actions (see the Step Functions page)	7 List, 9 Read, 2 Tagging, 19 Write; 37 restricted, 37 conditional	*
Storage Gateway	All 97 actions (see the Storage Gateway page)	12 List, 21 Read, 2 Tagging, 62 Write; 97 restricted, 97 conditional	*
STS	All 16 actions (see the STS page)	4 Read, 2 Tagging, 10 Write; 16 restricted, 16 conditional	*
Support	All 39 actions (see the Support page)	22 Read, 17 Write; 39 restricted, 39 conditional	*
Support Console	All 13 actions (see the Support Console page)	9 Read, 4 Write; 13 restricted, 13 conditional	*
Support App	All 13 actions (see the Support App page)	5 Read, 8 Write; 13 restricted, 13 conditional	*
Support Authorization	All 12 actions (see the Support Authorization page)	3 List, 3 Read, 2 Tagging, 4 Write; 12 restricted, 12 conditional	*
Support Plans	All 13 actions (see the Support Plans page)	3 List, 3 Read, 7 Write; 13 restricted, 13 conditional	*
Sustainability	All 5 actions (see the Sustainability page)	5 Read; 5 restricted, 5 conditional	*
SWF	All 32 actions (see the SWF page)	4 List, 3 Read, 2 Tagging, 23 Write; 32 restricted, 32 conditional	*
CloudWatch Synthetics	All 22 actions (see the CloudWatch Synthetics page)	3 List, 7 Read, 2 Tagging, 10 Write; 22 restricted, 22 conditional	*
Resource Group Tagging	All 9 actions (see the Resource Group Tagging page)	1 List, 5 Read, 2 Tagging, 1 Write; 9 restricted, 9 conditional	*
Tax Settings	All 23 actions (see the Tax Settings page)	12 Read, 11 Write; 23 restricted, 23 conditional	*
Textract	All 25 actions (see the Textract page)	14 Read, 2 Tagging, 9 Write; 25 restricted, 25 conditional	*
WorkSpaces Thin Client	All 18 actions (see the WorkSpaces Thin Client page)	5 List, 4 Read, 2 Tagging, 7 Write; 18 restricted, 18 conditional	*
Timestream	All 32 actions (see the Timestream page)	4 List, 9 Read, 2 Tagging, 17 Write; 32 restricted, 32 conditional	*
Timestream InfluxDB	All 24 actions (see the Timestream InfluxDB page)	4 List, 6 Read, 2 Tagging, 12 Write; 24 restricted, 24 conditional	*
Tiros	All 5 actions (see the Tiros page)	3 Read, 2 Write; 5 restricted, 5 conditional	*
Telco Network Builder	All 33 actions (see the Telco Network Builder page)	6 List, 9 Read, 2 Tagging, 16 Write; 33 restricted, 33 conditional	*
Transcribe	All 52 actions (see the Transcribe page)	9 List, 11 Read, 2 Tagging, 30 Write; 52 restricted, 52 conditional	*
Transfer	All 72 actions (see the Transfer page)	5 List, 23 Read, 2 Tagging, 42 Write; 72 restricted, 72 conditional	*
Transform	All 22 actions (see the Transform page)	2 List, 7 Read, 2 Tagging, 11 Write; 22 restricted, 22 conditional	*
Transform custom	All 58 actions (see the Transform custom page)	8 List, 2 Permissions management, 15 Read, 2 Tagging, 31 Write; 58 restricted, 58 conditional	*
Translate	All 19 actions (see the Translate page)	4 List, 6 Read, 2 Tagging, 7 Write; 19 restricted, 19 conditional	*
Trusted Advisor	All 42 actions (see the Trusted Advisor page)	7 List, 22 Read, 13 Write; 42 restricted, 42 conditional	*
Diagnostic tools	All 9 actions (see the Diagnostic tools page)	2 List, 4 Read, 2 Tagging, 1 Write; 9 restricted, 9 conditional	*
User Subscriptions	All 25 actions (see the User Subscriptions page)	7 List, 6 Read, 12 Write; 25 restricted, 25 conditional	*
User Experience Customization (UXC)	All 4 actions (see the User Experience Customization (UXC) page)	1 Read, 3 Write; 4 restricted, 4 conditional	*
Vendor Insights	All 24 actions (see the Vendor Insights page)	5 List, 6 Read, 2 Tagging, 11 Write; 24 restricted, 24 conditional	*
Verified Access	All 1 actions (see the Verified Access page)	1 Write; 1 restricted, 1 conditional	*
Verified Permissions	All 31 actions (see the Verified Permissions page)	5 List, 9 Read, 2 Tagging, 15 Write; 31 restricted, 31 conditional	*
Voice ID	All 31 actions (see the Voice ID page)	6 List, 8 Read, 2 Tagging, 15 Write; 31 restricted, 31 conditional	*
VPC Lattice	All 75 actions (see the VPC Lattice page)	15 List, 5 Permissions management, 15 Read, 2 Tagging, 38 Write; 75 restricted, 75 conditional	*
VPC Lattice Services	All 2 actions (see the VPC Lattice Services page)	2 Write; 2 restricted, 2 conditional	*
VPC Endpoints	All 1 actions (see the VPC Endpoints page)	1 Write; 1 restricted, 1 conditional	*
WAF	All 77 actions (see the WAF page)	15 List, 5 Permissions management, 19 Read, 2 Tagging, 36 Write; 77 restricted, 77 conditional	*
WAF Regional	All 81 actions (see the WAF Regional page)	16 List, 5 Permissions management, 20 Read, 2 Tagging, 38 Write; 81 restricted, 81 conditional	*
WAF V2	All 64 actions (see the WAF V2 page)	12 List, 2 Permissions management, 25 Read, 2 Tagging, 23 Write; 64 restricted, 64 conditional	*
WAM	All 1 actions (see the WAM page)	1 Write; 1 restricted, 1 conditional	*
Well-Architected Tool	All 95 actions (see the Well-Architected Tool page)	18 List, 27 Read, 2 Tagging, 48 Write; 95 restricted, 95 conditional	*
Wickr	All 48 actions (see the Wickr page)	21 Read, 2 Tagging, 25 Write; 48 restricted, 48 conditional	*
Q in Connect	All 97 actions (see the Q in Connect page)	18 List, 1 Permissions management, 23 Read, 2 Tagging, 53 Write; 97 restricted, 97 conditional	*
WorkDocs	All 61 actions (see the WorkDocs page)	14 List, 10 Read, 37 Write; 61 restricted, 61 conditional	*
WorkLink	All 34 actions (see the WorkLink page)	6 List, 9 Read, 2 Tagging, 17 Write; 34 restricted, 34 conditional	*
WorkMail	All 126 actions (see the WorkMail page)	22 List, 28 Read, 2 Tagging, 74 Write; 126 restricted, 126 conditional	*
WorkMail Message Flow	All 2 actions (see the WorkMail Message Flow page)	1 Read, 1 Write; 2 restricted, 2 conditional	*
WorkSpaces	All 103 actions (see the WorkSpaces page)	16 List, 3 Permissions management, 16 Read, 2 Tagging, 66 Write; 103 restricted, 103 conditional	*
WorkSpaces Managed Instances	All 14 actions (see the WorkSpaces Managed Instances page)	4 List, 1 Read, 2 Tagging, 7 Write; 14 restricted, 14 conditional	*
WorkSpaces Secure Browser	All 75 actions (see the WorkSpaces Secure Browser page)	26 Read, 2 Tagging, 47 Write; 75 restricted, 75 conditional	*
X-Ray	All 32 actions (see the X-Ray page)	2 List, 1 Permissions management, 13 Read, 2 Tagging, 14 Write; 32 restricted, 32 conditional	*

Data-plane actions (483)

By access level: 58 List, 3 Permissions management, 190 Read, 4 Tagging, 228 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
Agent Registry	All 3 actions (see the Agent Registry page)	1 List, 2 Read; 3 restricted, 3 conditional	*
DevOps Agent	All 4 actions (see the DevOps Agent page)	4 Read; 4 restricted, 4 conditional	*
MWAA	All 1 actions (see the MWAA page)	1 Write; 1 restricted, 1 conditional	*
AppConfig	All 2 actions (see the AppConfig page)	1 Read, 1 Write; 2 restricted, 2 conditional	*
Application Signals	All 2 actions (see the Application Signals page)	1 List, 1 Write; 2 restricted, 2 conditional	*
B2BI	All 7 actions (see the B2BI page)	1 Read, 6 Write; 7 restricted, 7 conditional	*
Bedrock	All 37 actions (see the Bedrock page)	3 List, 22 Read, 12 Write; 37 restricted, 37 conditional	*
Bedrock-Agentcore	All 62 actions (see the Bedrock-Agentcore page)	13 List, 13 Read, 36 Write; 62 restricted, 62 conditional	*
Keyspaces	All 2 actions (see the Keyspaces page)	2 Read; 2 restricted, 2 conditional	*
CloudFront KeyValueStore	All 6 actions (see the CloudFront KeyValueStore page)	1 List, 2 Read, 3 Write; 6 restricted, 6 conditional	*
CloudTrail-Data	All 1 actions (see the CloudTrail-Data page)	1 Write; 1 restricted, 1 conditional	*
CloudWatch	All 5 actions (see the CloudWatch page)	1 List, 3 Read, 1 Write; 5 restricted, 5 conditional	*
CodeGuru Profiler	All 2 actions (see the CodeGuru Profiler page)	2 Write; 2 restricted, 2 conditional	*
Cognito Identity	All 5 actions (see the Cognito Identity page)	3 Read, 2 Write; 5 restricted, 5 conditional	*
Data Exchange	All 1 actions (see the Data Exchange page)	1 Write; 1 restricted, 1 conditional	*
Deadline Cloud	All 29 actions (see the Deadline Cloud page)	10 List, 12 Read, 7 Write; 29 restricted, 29 conditional	*
DynamoDB	All 17 actions (see the DynamoDB page)	9 Read, 8 Write; 17 restricted, 17 conditional	*
Elastic Block Store	All 4 actions (see the Elastic Block Store page)	3 Read, 1 Write; 4 restricted, 4 conditional	*
EventBridge	All 3 actions (see the EventBridge page)	3 Write; 3 restricted, 3 conditional	*
Firehose	All 2 actions (see the Firehose page)	2 Write; 2 restricted, 2 conditional	*
GameLift Streams	All 12 actions (see the GameLift Streams page)	1 List, 4 Read, 7 Write; 12 restricted, 12 conditional	*
Geo Maps	All 2 actions (see the Geo Maps page)	2 Read; 2 restricted, 2 conditional	*
Geo Places	All 7 actions (see the Geo Places page)	7 Read; 7 restricted, 7 conditional	*
Geo Routes	All 5 actions (see the Geo Routes page)	5 Read; 5 restricted, 5 conditional	*
GuardDuty	All 1 actions (see the GuardDuty page)	1 Write; 1 restricted, 1 conditional	*
Connect Health	All 4 actions (see the Connect Health page)	2 Read, 2 Write; 4 restricted, 4 conditional	*
IoT SiteWise	All 22 actions (see the IoT SiteWise page)	2 List, 13 Read, 7 Write; 22 restricted, 22 conditional	*
IoT TwinMaker	All 3 actions (see the IoT TwinMaker page)	2 Read, 1 Write; 3 restricted, 3 conditional	*
Kendra Intelligent Ranking	All 1 actions (see the Kendra Intelligent Ranking page)	1 Read; 1 restricted, 1 conditional	*
Kinesis	All 5 actions (see the Kinesis page)	3 Read, 2 Write; 5 restricted, 5 conditional	*
Kinesis Video Streams	All 9 actions (see the Kinesis Video Streams page)	1 List, 6 Read, 2 Write; 9 restricted, 9 conditional	*
Lake Formation	All 1 actions (see the Lake Formation page)	1 Read; 1 restricted, 1 conditional	*
Lambda	All 14 actions (see the Lambda page)	1 Read, 13 Write; 14 restricted, 14 conditional	*
Lex	All 6 actions (see the Lex page)	1 Read, 5 Write; 6 restricted, 6 conditional	*
Machine Learning	All 1 actions (see the Machine Learning page)	1 Write; 1 restricted, 1 conditional	*
Managed Blockchain Query	All 9 actions (see the Managed Blockchain Query page)	5 List, 4 Read; 9 restricted, 9 conditional	*
HealthImaging	All 1 actions (see the HealthImaging page)	1 Read; 1 restricted, 1 conditional	*
Pinpoint	All 4 actions (see the Pinpoint page)	4 Write; 4 restricted, 4 conditional	*
Network Flow Monitor	All 12 actions (see the Network Flow Monitor page)	6 Read, 6 Write; 12 restricted, 12 conditional	*
Nova Act	All 4 actions (see the Nova Act page)	4 Write; 4 restricted, 4 conditional	*
Q Apps	All 18 actions (see the Q Apps page)	1 List, 4 Read, 13 Write; 18 restricted, 18 conditional	*
Q Business	All 26 actions (see the Q Business page)	6 List, 8 Read, 12 Write; 26 restricted, 26 conditional	*
QuickSight	All 2 actions (see the QuickSight page)	1 Read, 1 Write; 2 restricted, 2 conditional	*
RDS Data API	All 6 actions (see the RDS Data API page)	6 Write; 6 restricted, 6 conditional	*
CloudWatch RUM	All 1 actions (see the CloudWatch RUM page)	1 Write; 1 restricted, 1 conditional	*
S3	All 25 actions (see the S3 page)	3 List, 3 Permissions management, 8 Read, 4 Tagging, 7 Write; 25 restricted, 25 conditional	*
SageMaker	All 19 actions (see the SageMaker page)	1 List, 7 Read, 11 Write; 19 restricted, 19 conditional	*
ASC	All 5 actions (see the ASC page)	2 List, 2 Read, 1 Write; 5 restricted, 5 conditional	*
Cloud Map	All 2 actions (see the Cloud Map page)	2 Read; 2 restricted, 2 conditional	*
SES	All 2 actions (see the SES page)	2 Write; 2 restricted, 2 conditional	*
Signer	All 1 actions (see the Signer page)	1 Read; 1 restricted, 1 conditional	*
Pinpoint SMS Voice	All 8 actions (see the Pinpoint SMS Voice page)	1 Read, 7 Write; 8 restricted, 8 conditional	*
SNS	All 1 actions (see the SNS page)	1 Write; 1 restricted, 1 conditional	*
Social Messaging	All 6 actions (see the Social Messaging page)	6 Write; 6 restricted, 6 conditional	*
Systems Manager	All 2 actions (see the Systems Manager page)	2 Read; 2 restricted, 2 conditional	*
Step Functions	All 2 actions (see the Step Functions page)	2 Write; 2 restricted, 2 conditional	*
SWF	All 19 actions (see the SWF page)	2 List, 6 Read, 11 Write; 19 restricted, 19 conditional	*
Timestream	All 5 actions (see the Timestream page)	2 List, 2 Read, 1 Write; 5 restricted, 5 conditional	*
User Experience Customization (UXC)	All 2 actions (see the User Experience Customization (UXC) page)	2 Read; 2 restricted, 2 conditional	*
Well-Architected Tool	All 1 actions (see the Well-Architected Tool page)	1 Write; 1 restricted, 1 conditional	*
X-Ray	All 12 actions (see the X-Ray page)	2 List, 8 Read, 2 Write; 12 restricted, 12 conditional	*

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 12742 write, tagging or permissions-management actions, short of full control of any service.
Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
Grants every action (*), but only for scoped resources or under conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
Grants permissions-management actions on iam, but only for scoped resources or under conditions.
Grants permissions-management actions on organizations, but only for scoped resources or under conditions.
Grants permissions-management actions on sso, but only for scoped resources or under conditions.

Guidance

Practical scope

One statement, AllowAllMCPServiceActions, allows Action "*" on Resource "*" with the condition Bool aws:IsMcpServiceAction equal to "true". The IAM User Guide says this key is set to True only when the MCP service is authorizing an MCP service action, and that it does not refer to actions taken by the MCP service on other AWS services.

Use cases

Let a user call any AWS MCP service action when you do not need to specify permissions per AWS MCP service.

Prerequisites

The IAM User Guide says permissions for actions the MCP service takes on other AWS services must always be granted separately, in addition to MCP service actions.

Best practices

AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

The statement allows every action on every resource, but only when aws:IsMcpServiceAction is true. The condition limits it to MCP service actions; without that condition key set, the statement does not apply.
The policy does not cover actions the MCP service takes on other AWS services.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. The IAM User Guide lists it among its policies for users who need access to AWS services through AWS MCP servers.

Same domain

Frequently asked questions

When should I attach AWSMcpServiceActionsFullAccess?: The IAM User Guide says to use it when a user requires access to AWS services using AWS MCP servers and you do not need to specify permissions per AWS MCP service. The reference page says you can attach it to your users, groups and roles.
What does AWSMcpServiceActionsFullAccess grant?: It allows Action "*" on Resource "*" only when aws:IsMcpServiceAction is true, so it covers MCP service actions. It does not grant permissions for actions the MCP service takes on other AWS services; those must be granted separately.
What are the security risks of AWSMcpServiceActionsFullAccess?: The wildcard action is limited by the aws:IsMcpServiceAction condition, which is set to True only when the MCP service is authorizing an MCP service action. AWS managed policies don't grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllMCPServiceActions",
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:IsMcpServiceAction": "true"
        }
      }
    }
  ]
}

Version history

Current version v3, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "awsmcpserviceactionsfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSMcpServiceActionsFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSMcpServiceActionsFullAccess"),
);

Sources

AWSMcpServiceActionsFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
AWS global condition context keys (IAM User Guide) (retrieved 2026-11-13; supports practicalScope, securityConsiderations, faqs)
AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports useCases, prerequisites, bestPractices, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)