AWSTransformInfrastructureExecutorAccessBatch

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Grants developers execution role the permissions needed to execute AWS Transform Continuous Modernization CLI/agent to run assessments/transformations using AWS Batch, including uploading source code, retrieving results, monitoring Batch job status, reading logs, and managing transformation schedules.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch
Default version: v4
Created: 2026-07-20
Last edited: 2026-10-22
Services: batch, cloudformation, cloudwatch, ec2, iam, kms, lambda, logs, s3, scheduler, secretsmanager, sqs, tag

Control-plane actions (39)

By access level: 12 List, 15 Read, 12 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Batch	5 of 46	1 List, 4 Read; 5 restricted, 5 conditional	batch:DescribeComputeEnvironments, batch:DescribeJobDefinitions, batch:DescribeJobQueues, batch:DescribeJobs, batch:ListJobs
CloudFormation	2 of 104	2 List; 2 restricted, 2 conditional	cloudformation:DescribeStacks, cloudformation:ListStacks
CloudWatch	2 of 160	1 List, 1 Read; 2 restricted, 2 conditional	cloudwatch:GetDashboard, cloudwatch:ListDashboards
EC2	5 of 834	5 List; 5 restricted, 5 conditional	ec2:DescribeNatGateways, ec2:DescribeRouteTables, ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcs
IAM	4 of 190	1 List, 2 Read, 1 Write; 4 restricted, 4 conditional	iam:GetRole, iam:GetRolePolicy, iam:ListAttachedRolePolicies, iam:PassRole
KMS	3 of 58	3 Write; 3 restricted, 3 conditional	kms:Decrypt, kms:Encrypt, kms:GenerateDataKey
Lambda	1 of 121	1 Read; 1 restricted, 1 conditional	lambda:GetFunctionConfiguration
CloudWatch Logs	7 of 133	1 List, 2 Read, 4 Write; 7 restricted, 7 conditional	logs:CreateLogGroup, logs:CreateLogStream, logs:DescribeLogStreams, logs:FilterLogEvents, logs:GetLogEvents, logs:PutLogEvents, logs:PutRetentionPolicy
EventBridge Scheduler	6 of 13	1 List, 2 Read, 3 Write; 6 restricted, 6 conditional	scheduler:CreateSchedule, scheduler:DeleteSchedule, scheduler:GetSchedule, scheduler:GetScheduleGroup, scheduler:ListSchedules, scheduler:UpdateSchedule
Secrets Manager	2 of 27	2 Read; 2 restricted, 2 conditional	secretsmanager:DescribeSecret, secretsmanager:GetSecretValue
SQS	1 of 20	1 Write; 1 restricted, 1 conditional	sqs:SendMessage
Resource Group Tagging	1 of 9	1 Read; 1 restricted, 1 conditional	tag:GetResources

Batch: 5 actions

batch:DescribeComputeEnvironments (Read)
batch:DescribeJobDefinitions (Read)
batch:DescribeJobQueues (Read)
batch:DescribeJobs (Read)
batch:ListJobs (List)

CloudFormation: 2 actions

cloudformation:DescribeStacks (List)
cloudformation:ListStacks (List)

CloudWatch: 2 actions

cloudwatch:GetDashboard (Read)
cloudwatch:ListDashboards (List)

EC2: 5 actions

ec2:DescribeNatGateways (List)
ec2:DescribeRouteTables (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeSubnets (List)
ec2:DescribeVpcs (List)

IAM: 4 actions

iam:GetRole (Read)
iam:GetRolePolicy (Read)
iam:ListAttachedRolePolicies (List)
iam:PassRole (Write)

KMS: 3 actions

kms:Decrypt (Write)
kms:Encrypt (Write)
kms:GenerateDataKey (Write)

Lambda: 1 actions

lambda:GetFunctionConfiguration (Read)

CloudWatch Logs: 7 actions

logs:CreateLogGroup (Write)
logs:CreateLogStream (Write)
logs:DescribeLogStreams (List)
logs:FilterLogEvents (Read)
logs:GetLogEvents (Read)
logs:PutLogEvents (Write)
logs:PutRetentionPolicy (Write)

EventBridge Scheduler: 6 actions

scheduler:CreateSchedule (Write)
scheduler:DeleteSchedule (Write)
scheduler:GetSchedule (Read)
scheduler:GetScheduleGroup (Read)
scheduler:ListSchedules (List)
scheduler:UpdateSchedule (Write)

Secrets Manager: 2 actions

secretsmanager:DescribeSecret (Read)
secretsmanager:GetSecretValue (Read)

SQS: 1 actions

sqs:SendMessage (Write)

Resource Group Tagging: 1 actions

tag:GetResources (Read)

Data-plane actions (5)

By access level: 1 List, 1 Read, 3 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
Lambda	1 of 14	1 Write; 1 restricted, 1 conditional	lambda:InvokeFunction
S3	4 of 25	1 List, 1 Read, 2 Write; 4 restricted, 4 conditional	s3:AbortMultipartUpload, s3:GetObject, s3:ListBucket, s3:PutObject

Lambda: 1 actions

lambda:InvokeFunction (Write)

S3: 4 actions

s3:AbortMultipartUpload (Write)
s3:GetObject (Read)
s3:ListBucket (List)
s3:PutObject (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 15 write, tagging or permissions-management actions, short of full control of any service.
Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LambdaInvokeATXFunctions",
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunction",
        "lambda:GetFunctionConfiguration"
      ],
      "Resource": [
        "arn:aws:lambda:*:*:function:atx-trigger-job-*",
        "arn:aws:lambda:*:*:function:atx-trigger-batch-jobs-*",
        "arn:aws:lambda:*:*:function:atx-get-job-status-*",
        "arn:aws:lambda:*:*:function:atx-get-batch-status-*",
        "arn:aws:lambda:*:*:function:atx-list-jobs-*",
        "arn:aws:lambda:*:*:function:atx-list-batches-*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3UploadSourceCode",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::atx-source-code-*",
        "arn:aws:s3:::atx-source-code-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3DownloadResults",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::atx-custom-output-*",
        "arn:aws:s3:::atx-custom-output-*/*",
        "arn:aws:s3:::atx-ct-output-*",
        "arn:aws:s3:::atx-ct-output-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3WriteBatchSidecar",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::atx-custom-output-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "KMSEncryptDecrypt",
      "Effect": "Allow",
      "Action": [
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "arn:aws:kms:*:*:key/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        },
        "ForAnyValue:StringLike": {
          "kms:ResourceAliases": [
            "alias/atx-encryption-key",
            "alias/atx-encryption-key-*"
          ]
        }
      }
    },
    {
      "Sid": "CloudWatchReadLogs",
      "Effect": "Allow",
      "Action": [
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "logs:DescribeLogStreams"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/batch/atx-transform*",
        "arn:aws:logs:*:*:log-group:/aws/batch/job*",
        "arn:aws:logs:*:*:log-group:AtxVpc*",
        "arn:aws:logs:*:*:log-group:/aws/lambda/atx-*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CmodCustomerLogGroupManagement",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:PutRetentionPolicy"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CmodCustomerLogStreamWrite",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": [
        "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization:log-stream:local/*",
        "arn:aws:logs:*:*:log-group:/aws/TransformContinuousModernization:log-stream:batch/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CloudWatchDashboard",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetDashboard",
        "cloudwatch:ListDashboards"
      ],
      "Resource": [
        "arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard",
        "arn:aws:cloudwatch::*:dashboard/ATX-Transform-CLI-Dashboard-*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "BatchDescribe",
      "Effect": "Allow",
      "Action": [
        "batch:DescribeComputeEnvironments",
        "batch:DescribeJobQueues",
        "batch:DescribeJobDefinitions",
        "batch:DescribeJobs",
        "batch:ListJobs"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CheckInfrastructureStatus",
      "Effect": "Allow",
      "Action": "cloudformation:DescribeStacks",
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack/*",
        "arn:aws:cloudformation:*:*:stack/AtxInfrastructureStack-*/*",
        "arn:aws:cloudformation:*:*:stack/atx-*",
        "arn:aws:cloudformation:*:*:stack/atx-*/*",
        "arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*",
        "arn:aws:cloudformation:*:*:stack/AtxDispatcherStack/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SecretsManagerATXSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue",
        "secretsmanager:DescribeSecret"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:atx/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SchedulerManage",
      "Effect": "Allow",
      "Action": [
        "scheduler:CreateSchedule",
        "scheduler:DeleteSchedule",
        "scheduler:GetSchedule",
        "scheduler:UpdateSchedule",
        "scheduler:GetScheduleGroup",
        "scheduler:ListSchedules"
      ],
      "Resource": [
        "arn:aws:scheduler:*:*:schedule-group/atx-ct",
        "arn:aws:scheduler:*:*:schedule-group/atx-ct-*",
        "arn:aws:scheduler:*:*:schedule/atx-ct/*",
        "arn:aws:scheduler:*:*:schedule/atx-ct-*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "PassSchedulerRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AtxSchedulerInvocationRole",
        "arn:aws:iam::*:role/AtxSchedulerInvocationRole-*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "scheduler.amazonaws.com",
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "EC2NetworkDiscovery",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeNatGateways"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "IAMReadRoles",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListAttachedRolePolicies",
        "iam:GetRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/ATX*",
        "arn:aws:iam::*:role/Atx*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "TagGetATXStacks",
      "Effect": "Allow",
      "Action": "tag:GetResources",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CFNListStacksForDetect",
      "Effect": "Allow",
      "Action": "cloudformation:ListStacks",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SQSEnqueueToDispatcher",
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:*:*:atx-dispatcher-queue",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}

Version history

Current version v4, edited by AWS on 2026-10-22. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch

Terraform

resource "aws_iam_role_policy_attachment" "awstransforminfrastructureexecutoraccessbatch" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessBatch"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSTransformInfrastructureExecutorAccessBatch"),
);

Sources

Pending editorial review. No editorial sources are listed yet.