AWSResourceGroupsReadOnlyAccess

Summary

The read only policy for AWS Resource Groups, as the AWS Managed Policy Reference Guide describes it.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccessCopy ARN

Default version

v2

Created

2018-03-07

Last edited

2019-02-05

Services

cloudformation, ec2, elasticache, elasticbeanstalk, elasticloadbalancing, elasticmapreduce, glacier, kinesis, opsworks, rds, redshift, resource-groups, route53, route53domains, s3, ssm, storagegateway, tag

Control-plane actions (57)

By access level: 33 List, 24 Read.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AmazonSageMakerModelRegistryFullAccess
• AmazonSSMMaintenanceWindowRole
• AWSServiceCatalogAppRegistryFullAccess
• AWSServiceCatalogAppRegistryServiceRolePolicy
• AWSSSMForSAPServiceLinkedRolePolicy
• ResourceGroupsandTagEditorFullAccess
• ResourceGroupsandTagEditorReadOnlyAccess

Same domain

• AccountAccessManagerServiceRolePolicy
• AIDevOpsAgentAccessPolicy
• AIDevOpsOrganizationsAccessPolicy
• AmazonCloudWatchEvidentlyServiceRolePolicy
• AmazonCodeCatalystSupportAccess
• AmazonDetectiveOrganizationsAccess
• AmazonDetectiveServiceLinkedRolePolicy
• AmazonDevOpsGuruOrganizationsAccess

Frequently asked questions

When should I attach AWSResourceGroupsReadOnlyAccess?

The reference page describes it as the read only policy for AWS Resource Groups, and says you can attach it to users, groups and roles. Attach it for people who need to view resource groups.

What does AWSResourceGroupsReadOnlyAccess grant?

It allows resource-groups:Get*, List* and Search*, tag:Get*, and a set of describe and list actions across CloudFormation, EC2, ElastiCache, Elastic Beanstalk, EMR, S3 Glacier, Kinesis, OpsWorks, RDS, Redshift, Route 53, Storage Gateway, S3, Elastic Load Balancing and Systems Manager, all on all resources.

What are the security risks of AWSResourceGroupsReadOnlyAccess?

The permissions are reads, but they cover many services on all resources, so a holder can see resource inventory and tags broadly. AWS managed policies do not grant least privilege permissions, and an AWS update to the policy affects every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "resource-groups:Get*",
        "resource-groups:List*",
        "resource-groups:Search*",
        "tag:Get*",
        "cloudformation:DescribeStacks",
        "cloudformation:ListStackResources",
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSnapshots",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcs",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeSnapshots",
        "elasticache:ListTagsForResource",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticmapreduce:DescribeCluster",
        "elasticmapreduce:ListClusters",
        "glacier:ListVaults",
        "glacier:DescribeVault",
        "glacier:ListTagsForVault",
        "kinesis:ListStreams",
        "kinesis:DescribeStream",
        "kinesis:ListTagsForStream",
        "opsworks:DescribeStacks",
        "opsworks:ListTags",
        "rds:DescribeDBInstances",
        "rds:DescribeDBSnapshots",
        "rds:ListTagsForResource",
        "redshift:DescribeClusters",
        "redshift:DescribeTags",
        "route53domains:ListDomains",
        "route53:ListHealthChecks",
        "route53:GetHealthCheck",
        "route53:ListHostedZones",
        "route53:GetHostedZone",
        "route53:ListTagsForResource",
        "storagegateway:ListGateways",
        "storagegateway:DescribeGatewayInformation",
        "storagegateway:ListTagsForResource",
        "s3:ListAllMyBuckets",
        "s3:GetBucketTagging",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTags",
        "ssm:ListDocuments"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Version history

Current version v2, edited by AWS on 2019-02-05. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess

resource "aws_iam_role_policy_attachment" "awsresourcegroupsreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSResourceGroupsReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSResourceGroupsReadOnlyAccess"),
);

Sources

• AWSResourceGroupsReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AWSResourceGroupsReadOnlyAccess
• Report a data issue