MultiPartyApprovalReadOnlyAccess

Summary

Provides read-only access to Multi-party approval, plus related read permissions to AWS Organizations and AWS IAM Identity Center for approval teams and identity sources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccessCopy ARN

Default version

v6

Created

2025-06-18

Last edited

2026-02-12

Services

kms, mpa, organizations, sso, sso-directory

Control-plane actions (21)

By access level: 9 List, 11 Read, 1 Write.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 1 write, tagging or permissions-management action, short of full control of any service.

Guidance

Related policies

Same service

• AIOpsConsoleAdminPolicy
• AmazonBioDiscoveryFullAccess
• AmazonBioDiscoveryInAppFullAccess
• AmazonHoneycodeServiceRolePolicy
• AWSControlTowerIdentityCenterManagementPolicy
• AWSGrafanaWorkspacePermissionManagement
• AWSGrafanaWorkspacePermissionManagementV2
• AWSManagedAccountUserEntitlementAccess

Same domain

• AccessAnalyzerServiceRolePolicy
• AccountManagementFromVercel
• AlexaForBusinessNetworkProfileServicePolicy
• AmazonAppStreamPCAAccess
• AmazonChimeServiceRolePolicy
• AmazonCloudDirectoryFullAccess
• AmazonCloudDirectoryReadOnlyAccess
• AmazonCloudWatchEvidentlyReadOnlyAccess

Frequently asked questions

When should I attach MultiPartyApprovalReadOnlyAccess?

The reference page says you can attach MultiPartyApprovalReadOnlyAccess to your users, groups and roles, and describes it as: provides read-only access to Multi-party approval and related read permissions to AWS Organizations and AWS IAM Identity Center. Attach it where viewing Multi-party approval is the intended scope.

What does MultiPartyApprovalReadOnlyAccess grant?

It allows mpa:Get* and mpa:List*, two AWS Organizations read actions, four sso read actions, sso-directory:DescribeUsers and sso-directory:SearchUsers on all resources, and kms:Decrypt under IAM Identity Center and identity store conditions.

What are the security risks of MultiPartyApprovalReadOnlyAccess?

It has no mpa write actions, but it can search IAM Identity Center directory users and includes kms:Decrypt under conditions. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MpaReadAccess",
      "Effect": "Allow",
      "Action": [
        "mpa:Get*",
        "mpa:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OrganizationsAccess",
      "Effect": "Allow",
      "Action": [
        "organizations:ListDelegatedAdministrators",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSOManagementAccess",
      "Effect": "Allow",
      "Action": [
        "sso:DescribeInstance",
        "sso:ListInstances",
        "sso:DescribeRegisteredRegions",
        "sso:GetSharedSsoConfiguration",
        "sso-directory:DescribeUsers",
        "sso-directory:SearchUsers"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowKmsAccessViaIdentityCenter",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:sso:instance-arn": "arn:*:sso:::instance/*"
        },
        "StringLike": {
          "kms:ViaService": "sso.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowKmsAccessViaIdentityStore",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "ArnLike": {
          "kms:EncryptionContext:aws:identitystore:identitystore-arn": "arn:*:identitystore::*:identitystore/*"
        },
        "StringLike": {
          "kms:ViaService": "identitystore.*.amazonaws.com"
        }
      }
    }
  ]
}

Version history

Current version v6, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess

resource "aws_iam_role_policy_attachment" "multipartyapprovalreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/MultiPartyApprovalReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("MultiPartyApprovalReadOnlyAccess"),
);

Sources

• MultiPartyApprovalReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for Multi-party approval (retrieved 2026-11-13; supports bestPractices, securityConsiderations, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports faqs)

• Official AWS reference for MultiPartyApprovalReadOnlyAccess
• AWS service guide
• Report a data issue