AWSRefactoringToolkitFullAccess

Summary

Grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio. The description says it is intended to be attached to a local AWS profile.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccessCopy ARN

Default version

v8

Created

2022-10-25

Last edited

2026-02-12

Services

a2c, application-transformation, clouddirectory, cloudformation, codebuild, ds, ec2, ecr, ecs, iam, kms, logs, s3, secretsmanager, ssm, ssmmessages

Control-plane actions (110)

By access level: 22 List, 1 Permissions management, 28 Read, 11 Tagging, 48 Write.

Data-plane actions (4)

By access level: 1 List, 1 Read, 2 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 62 write, tagging or permissions-management actions, short of full control of any service.
• Grants data-plane write actions on a data store, but only for scoped resources or under conditions.

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsReleaseManagementVPCPolicy
• AmazonAppStreamServiceAccess
• AmazonBioDiscoveryServiceLinkedRolePolicy
• AmazonBraketJobsExecutionPolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneProjectDeploymentPermissionsBoundary
• AmazonDataZoneProjectRolePermissionsBoundary

Same domain

• AmazonEC2ContainerRegistryFullAccess
• AmazonEC2ContainerRegistryPowerUser
• AmazonEC2ContainerRegistryPullOnly
• AmazonEC2ContainerRegistryReadOnly
• AmazonEC2ContainerServiceAutoscaleRole
• AmazonEC2ContainerServiceEventsRole
• AmazonEC2ContainerServiceforEC2Role
• AmazonECSInstanceRolePolicyForManagedInstances

Frequently asked questions

When should I attach AWSRefactoringToolkitFullAccess?

The description says it grants permission to use AWS services with the AWS Toolkit for .NET Refactoring extension for Microsoft Visual Studio and is intended to be attached to a local AWS profile. The reference page says you can attach it to your users, groups and roles.

What does AWSRefactoringToolkitFullAccess grant?

It allows uploading and downloading application artifacts in Amazon S3, building container images with AWS CodeBuild, storing images in Amazon ECR, and deploying to Amazon ECS, plus optional VPC creation and connection to existing infrastructure such as AWS Directory Service. Most write actions are limited by name patterns or a2c-generated and application-transformation tags.

What are the security risks of AWSRefactoringToolkitFullAccess?

It can create networking, container, build and deployment resources and run commands in containers, and ec2:CreateSecurityGroup is allowed on all resources without a condition. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "a2c:GetContainerizationJobDetails",
        "a2c:GetDeploymentJobDetails",
        "a2c:StartContainerizationJob",
        "a2c:StartDeploymentJob"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateChangeSet",
        "cloudformation:CreateStack",
        "cloudformation:DescribeChangeSet",
        "cloudformation:DescribeStackEvents",
        "cloudformation:ExecuteChangeSet",
        "cloudformation:UpdateStack",
        "cloudformation:TagResource",
        "cloudformation:UntagResource"
      ],
      "Resource": [
        "arn:*:cloudformation:*:*:stack/a2c-app-*",
        "arn:*:cloudformation:*:*:stack/a2c-build-*",
        "arn:*:cloudformation:*:*:stack/application-transformation-app-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "codebuild:CreateProject",
        "codebuild:UpdateProject"
      ],
      "Resource": "arn:aws:codebuild:*:*:project/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "codebuild:StartBuild"
      ],
      "Resource": "arn:aws:codebuild:*:*:project/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateInternetGateway",
        "ec2:CreateKeyPair",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateVpc",
        "ec2:AuthorizeSecurityGroupIngress"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateInternetGateway",
        "ec2:CreateKeyPair",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSubnet",
        "ec2:CreateVpc",
        "ec2:AuthorizeSecurityGroupIngress"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "application-transformation.amazonaws.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": [
            "AuthorizeSecurityGroupIngress",
            "CreateInternetGateway",
            "CreateKeyPair",
            "CreateRoute",
            "CreateRouteTable",
            "CreateSubnet",
            "CreateVpc"
          ]
        },
        "Null": {
          "aws:RequestTag/application-transformation": "false"
        },
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "application-transformation.amazonaws.com"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:AssociateRouteTable",
        "ec2:AttachInternetGateway",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteTags",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyVpcAttribute",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:CreateSubnet",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:AssociateRouteTable",
        "ec2:AttachInternetGateway",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:DeleteTags",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyVpcAttribute",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:CreateSubnet",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:CreateRepository",
        "ecr:TagResource"
      ],
      "Resource": "arn:*:ecr:*:*:repository/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:CreateRepository",
        "ecr:TagResource"
      ],
      "Resource": "arn:*:ecr:*:*:repository/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetLifecyclePolicy",
        "ecr:GetRepositoryPolicy",
        "ecr:ListImages",
        "ecr:ListTagsForResource",
        "ecr:TagResource",
        "ecr:UntagResource"
      ],
      "Resource": "arn:*:ecr:*:*:repository/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetLifecyclePolicy",
        "ecr:GetRepositoryPolicy",
        "ecr:ListImages",
        "ecr:ListTagsForResource",
        "ecr:TagResource",
        "ecr:UntagResource"
      ],
      "Resource": "arn:*:ecr:*:*:repository/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:CreateService",
        "ecs:RegisterTaskDefinition",
        "ecs:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:CreateCluster",
        "ecs:CreateService",
        "ecs:RegisterTaskDefinition",
        "ecs:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:RequestTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:UpdateService",
        "ecs:TagResource",
        "ecs:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:UpdateService",
        "ecs:TagResource",
        "ecs:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeTaskDefinition"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "cloudformation.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:ExecuteCommand"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:container-name": "a2c-sidecar"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:ExecuteCommand"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:container-name": "application-transformation-sidecar"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "ecs.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:TagResource"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/a2c-generated": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "a2c-generated"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:TagResource"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/application-transformation": "false"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "application-transformation"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/codebuild/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/a2c-generated": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/ecs/containerinsights/*:*",
        "arn:aws:logs:*:*:log-group:/aws/ecs/container-logs/*:*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:AddTagsToResource",
        "ssm:GetParameters",
        "ssm:PutParameter",
        "ssm:RemoveTagsFromResource"
      ],
      "Resource": "arn:aws:ssm:*:*:parameter/a2c-generated-check-ecs-slr-*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:DescribeSessions",
        "ssmmessages:CreateControlChannel",
        "ssmmessages:CreateDataChannel",
        "ssmmessages:OpenControlChannel",
        "ssmmessages:OpenDataChannel"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::*/refactoringtoolkit*",
        "arn:aws:s3:::*/a2c-generated*",
        "arn:aws:s3:::*/application-transformation*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::*",
      "Condition": {
        "StringLike": {
          "s3:prefix": [
            "application-transformation",
            "refactoringtoolkit"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:ListStacks",
        "clouddirectory:ListDirectories",
        "codebuild:BatchGetProjects",
        "codebuild:BatchGetBuilds",
        "ds:DescribeDirectories",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeImages",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "ec2:DescribeRegions",
        "ecr:DescribeImages",
        "ecr:DescribeRepositories",
        "ecs:DescribeClusters",
        "ecs:DescribeServices",
        "ecs:DescribeTasks",
        "ecs:ListTagsForResource",
        "ecs:ListTasks",
        "iam:ListRoles",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:ListAllMyBuckets",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:GetRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::aws.portingassistant.dotnet.datastore",
        "arn:aws:s3:::aws.portingassistant.dotnet.datastore/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "application-transformation:StartPortingCompatibilityAssessment",
        "application-transformation:GetPortingCompatibilityAssessment",
        "application-transformation:StartPortingRecommendationAssessment",
        "application-transformation:GetPortingRecommendationAssessment",
        "application-transformation:PutLogData",
        "application-transformation:PutMetricData",
        "application-transformation:StartContainerization",
        "application-transformation:GetContainerization",
        "application-transformation:StartDeployment",
        "application-transformation:GetDeployment"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:DescribeKey",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*::*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "kms:ResourceAliases": "alias/application-transformation*"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart",
        "ecr:CompleteLayerUpload",
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Resource": "arn:*:ecr:*:*:repository/*",
      "Condition": {
        "Null": {
          "ecr:ResourceTag/application-transformation": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "arn:aws:kms:*::*",
      "Condition": {
        "Bool": {
          "kms:GrantIsForAWSResource": true
        },
        "ForAnyValue:StringLike": {
          "kms:ResourceAliases": "alias/application-transformation*"
        }
      }
    }
  ]
}

Version history

Current version v8, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess

resource "aws_iam_role_policy_attachment" "awsrefactoringtoolkitfullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSRefactoringToolkitFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSRefactoringToolkitFullAccess"),
);

Sources

• AWSRefactoringToolkitFullAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs, useCases)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for AWSRefactoringToolkitFullAccess
• Report a data issue