Skip to main content
IAM Policy Map

IAMReadOnlyAccess

ReaderAWS managedActiveReviewedShow on mapCompare

Summary

Provides read only access to IAM via the AWS Management Console. The IAM User Guide says it grants permission to get and list all IAM resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN
arn:aws:iam::aws:policy/IAMReadOnlyAccess
Default version
v4
Created
Last edited
Services
iam

Control-plane actions (76)

By access level: 40 List, 36 Read.

Control-plane actions by service
ServiceGrantedAccess levels and limitsGranted by
IAM76 of 19040 List, 36 Read; 0 restricted, 0 conditionaliam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:Get*, iam:List*, iam:SimulateCustomPolicy, iam:SimulatePrincipalPolicy
IAM: 76 actions
  • iam:GenerateCredentialReport (Read)
  • iam:GenerateServiceLastAccessedDetails (Read)
  • iam:GetAccessKeyLastUsed (Read)
  • iam:GetAccountAuthorizationDetails (Read)
  • iam:GetAccountEmailAddress (Read)
  • iam:GetAccountName (Read)
  • iam:GetAccountPasswordPolicy (Read)
  • iam:GetAccountProperties (Read)
  • iam:GetAccountSummary (List)
  • iam:GetCloudFrontPublicKey (Read)
  • iam:GetContextKeysForCustomPolicy (Read)
  • iam:GetContextKeysForPrincipalPolicy (Read)
  • iam:GetCredentialReport (Read)
  • iam:GetDelegationRequest (Read)
  • iam:GetGroup (Read)
  • iam:GetGroupPolicy (Read)
  • iam:GetHumanReadableSummary (Read)
  • iam:GetInstanceProfile (Read)
  • iam:GetLoginProfile (List)
  • iam:GetMFADevice (Read)
  • iam:GetOpenIDConnectProvider (Read)
  • iam:GetOrganizationsAccessReport (Read)
  • iam:GetOutboundWebIdentityFederationInfo (Read)
  • iam:GetPolicy (Read)
  • iam:GetPolicyVersion (Read)
  • iam:GetRole (Read)
  • iam:GetRolePolicy (Read)
  • iam:GetRoleTemplateVersion (Read)
  • iam:GetSAMLProvider (Read)
  • iam:GetSSHPublicKey (Read)
  • iam:GetServerCertificate (Read)
  • iam:GetServiceLastAccessedDetails (Read)
  • iam:GetServiceLastAccessedDetailsWithEntities (Read)
  • iam:GetServiceLinkedRoleDeletionStatus (Read)
  • iam:GetUser (Read)
  • iam:GetUserPolicy (Read)
  • iam:ListAccessKeys (List)
  • iam:ListAccountAliases (List)
  • iam:ListAttachedGroupPolicies (List)
  • iam:ListAttachedRolePolicies (List)
  • iam:ListAttachedUserPolicies (List)
  • iam:ListCloudFrontPublicKeys (List)
  • iam:ListDelegationRequests (List)
  • iam:ListEntitiesForPolicy (List)
  • iam:ListGroupPolicies (List)
  • iam:ListGroups (List)
  • iam:ListGroupsForUser (List)
  • iam:ListInstanceProfileTags (List)
  • iam:ListInstanceProfiles (List)
  • iam:ListInstanceProfilesForRole (List)
  • iam:ListMFADeviceTags (List)
  • iam:ListMFADevices (List)
  • iam:ListOpenIDConnectProviderTags (List)
  • iam:ListOpenIDConnectProviders (List)
  • iam:ListOrganizationsFeatures (List)
  • iam:ListPolicies (List)
  • iam:ListPoliciesGrantingServiceAccess (List)
  • iam:ListPolicyTags (List)
  • iam:ListPolicyVersions (List)
  • iam:ListRolePolicies (List)
  • iam:ListRoleTags (List)
  • iam:ListRoles (List)
  • iam:ListSAMLProviderTags (List)
  • iam:ListSAMLProviders (List)
  • iam:ListSSHPublicKeys (List)
  • iam:ListSTSRegionalEndpointsStatus (List)
  • iam:ListServerCertificateTags (List)
  • iam:ListServerCertificates (List)
  • iam:ListServiceSpecificCredentials (List)
  • iam:ListSigningCertificates (List)
  • iam:ListUserPolicies (List)
  • iam:ListUserTags (List)
  • iam:ListUsers (List)
  • iam:ListVirtualMFADevices (List)
  • iam:SimulateCustomPolicy (Read)
  • iam:SimulatePrincipalPolicy (Read)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

  • Grants only List and Read actions.

Guidance

Practical scope

The policy allows iam:Get*, iam:List*, iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:SimulateCustomPolicy and iam:SimulatePrincipalPolicy on Resource "*". The IAM User Guide says it allows viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices. It does not include the ability to create or delete resources, or access to IAM Access Analyzer resources.

Use cases

  • Give users, groups or roles read only access to IAM resources, including viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices.

Best practices

  • AWS managed policies might not grant least-privilege permissions for your use case. AWS recommends reducing permissions further with customer managed policies specific to your use cases.

Security considerations

  • The policy applies to all IAM resources: iam:Get* and iam:List* allow getting and listing all IAM resources, including details on users, groups, roles, policies, identity providers and MFA devices.
  • You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. It fits where read only access to IAM is intended. Where a narrower scope is needed, AWS recommends a customer managed policy specific to the use case.

Related policies

Same service

Same domain

Frequently asked questions

When should I attach IAMReadOnlyAccess?
The IAM User Guide says to use it to allow read only access to IAM resources. Attach it where viewing details and activity reports for users, groups, roles, policies, identity providers and MFA devices is the intended scope. If you need less, AWS recommends a customer managed policy specific to your use case.
What does IAMReadOnlyAccess grant?
It allows iam:Get*, iam:List*, iam:GenerateCredentialReport, iam:GenerateServiceLastAccessedDetails, iam:SimulateCustomPolicy and iam:SimulatePrincipalPolicy on all resources. It does not include the ability to create or delete resources or access to IAM Access Analyzer resources.
What are the security risks of IAMReadOnlyAccess?
It grants no create or delete actions, but iam:Get* and iam:List* apply to all IAM resources, so the holder can view details of users, groups, roles, policies, identity providers and MFA devices. AWS managed policies might not grant least-privilege permissions for your use case, and AWS recommends reducing permissions further with customer managed policies. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:GenerateCredentialReport",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:Get*",
        "iam:List*",
        "iam:SimulateCustomPolicy",
        "iam:SimulatePrincipalPolicy"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v4, edited by AWS on 2018-01-25. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/IAMReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/IAMReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/IAMReadOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/IAMReadOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "iamreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("IAMReadOnlyAccess"),
);

Sources