AWSServiceCatalogAdminReadOnlyAccess

Summary

Provides read-only access to Service Catalog admin capabilities. The AWS Service Catalog AppRegistry page of the Administrator Guide says it grants read-only permissions with full access to the administrator console view, and does not grant access to create or manage products and portfolios.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccessCopy ARN

Default version

v1

Created

2019-10-25

Last edited

2019-10-25

Services

cloudformation, config, iam, servicecatalog, ssm

Control-plane actions (75)

By access level: 39 List, 36 Read.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Related policies

Same service

• AdministratorAccess-AWSElasticBeanstalk
• AIDevOpsOrganizationsAccessPolicy
• AmazonDataZoneRedshiftGlueProvisioningPolicy
• AmazonLaunchWizard_Fullaccess
• AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy
• AmazonSSMServiceRolePolicy
• AmplifyBackendDeployFullAccess
• AWSAppMeshFullAccess

Same domain

• AccountAccessManagerServiceRolePolicy
• AIDevOpsAgentAccessPolicy
• AmazonCloudWatchEvidentlyServiceRolePolicy
• AmazonCodeCatalystSupportAccess
• AmazonDetectiveOrganizationsAccess
• AmazonDetectiveServiceLinkedRolePolicy
• AmazonDevOpsGuruOrganizationsAccess
• AmazonDevOpsGuruServiceRolePolicy

Frequently asked questions

When should I attach AWSServiceCatalogAdminReadOnlyAccess?

The Administrator Guide says it grants read-only permissions to the administrator console view and does not allow creating or managing products and portfolios. Attach it to people who need to view Service Catalog administration but not change it. AppRegistry also attaches it to its own service role.

What does AWSServiceCatalogAdminReadOnlyAccess grant?

It allows servicecatalog Get, List, Describe, Search and ScanProvisionedProducts actions, CloudFormation describe and list actions on SC-* stacks, change sets and stack sets, iam get and list actions for users, groups and roles, Systems Manager document reads, and AWS Config configuration recorder describe actions.

What are the security risks of AWSServiceCatalogAdminReadOnlyAccess?

The policy allows only read-style actions, but they apply to all resources for servicecatalog, iam, ssm and config. The IAM User Guide says AWS managed policies don't grant least privilege permissions, and AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeChangeSet",
        "cloudformation:ListChangeSets",
        "cloudformation:ListStackResources",
        "cloudformation:DescribeStackSet",
        "cloudformation:DescribeStackInstance",
        "cloudformation:DescribeStackSetOperation",
        "cloudformation:ListStackInstances",
        "cloudformation:ListStackSetOperations",
        "cloudformation:ListStackSetOperationResults"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/SC-*",
        "arn:aws:cloudformation:*:*:stack/StackSet-SC-*",
        "arn:aws:cloudformation:*:*:changeSet/SC-*",
        "arn:aws:cloudformation:*:*:stackset/SC-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:GetTemplateSummary",
        "iam:GetGroup",
        "iam:GetRole",
        "iam:GetUser",
        "iam:ListGroups",
        "iam:ListRoles",
        "iam:ListUsers",
        "servicecatalog:Get*",
        "servicecatalog:List*",
        "servicecatalog:Describe*",
        "servicecatalog:ScanProvisionedProducts",
        "servicecatalog:Search*",
        "ssm:DescribeDocument",
        "ssm:GetAutomationExecution",
        "ssm:ListDocuments",
        "ssm:ListDocumentVersions",
        "config:DescribeConfigurationRecorders",
        "config:DescribeConfigurationRecorderStatus"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v1, edited by AWS on 2019-10-25. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess

resource "aws_iam_role_policy_attachment" "awsservicecatalogadminreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSServiceCatalogAdminReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSServiceCatalogAdminReadOnlyAccess"),
);

Sources

• AWSServiceCatalogAdminReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for AWS Service Catalog AppRegistry (AWS Service Catalog Administrator Guide) (retrieved 2026-11-13; supports summary, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)

• Official AWS reference for AWSServiceCatalogAdminReadOnlyAccess
• AWS service guide
• Report a data issue