When should I attach NetworkAdministrator?

Attach it to a user who is tasked with setting up and maintaining AWS network resources. It is the Network administrator job function, which AWS designed to align with a common job function in the IT industry.

What are the security risks of NetworkAdministrator?

Most of its statements apply to all resources and include create, modify and delete actions for network resources. It allows iam:PassRole, limited to roles named flow-logs-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

NetworkAdministrator

AdminJob functionActiveReviewedShow on map Compare

Summary

A job function policy that grants full access permissions to AWS services and actions required to set up and configure AWS network resources.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/job-function/NetworkAdministrator
Default version: v16
Created: 2016-11-10
Last edited: 2026-07-09
Services: autoscaling, cloudfront, cloudwatch, directconnect, ec2, elasticbeanstalk, elasticloadbalancing, iam, interconnect, logs, networkmanager, route53, route53domains, s3, sns

Control-plane actions (625)

By access level: 146 List, 7 Permissions management, 112 Read, 13 Tagging, 347 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
EC2 Auto Scaling	22 of 68	21 List, 1 Read; 0 restricted, 0 conditional	autoscaling:Describe*
CloudFront	1 of 173	1 List; 0 restricted, 0 conditional	cloudfront:ListDistributions
CloudWatch	3 of 160	1 Read, 2 Write; 0 restricted, 0 conditional	cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms, cloudwatch:PutMetricAlarm
Direct Connect	All 73 actions (see the Direct Connect page)	4 List, 19 Read, 2 Tagging, 48 Write; 0 restricted, 0 conditional	directconnect:*
EC2	201 of 834	61 List, 3 Permissions management, 2 Read, 2 Tagging, 133 Write; 0 restricted, 0 conditional	ec2:AcceptTransitGatewayVpcAttachment, ec2:AcceptVpcEndpointConnections, ec2:AcceptVpcPeeringConnection, ec2:AllocateAddress, ec2:AssignIpv6Addresses, ec2:AssignPrivateIpAddresses, ec2:AssociateAddress, ec2:AssociateDhcpOptions, ec2:AssociateRouteTable, ec2:AssociateSecurityGroupVpc, ec2:AssociateSubnetCidrBlock, ec2:AssociateTransitGatewayRouteTable and 189 more
Elastic Beanstalk	19 of 50	6 List, 13 Read; 0 restricted, 0 conditional	elasticbeanstalk:Describe, elasticbeanstalk:List, elasticbeanstalk:RequestEnvironmentInfo, elasticbeanstalk:RetrieveEnvironmentInfo
ELB	All 77 actions (see the ELB page)	2 List, 1 Permissions management, 22 Read, 2 Tagging, 50 Write; 0 restricted, 0 conditional	elasticloadbalancing:*
IAM	4 of 190	1 List, 1 Read, 2 Write; 4 restricted, 1 conditional	iam:CreateServiceLinkedRole, iam:GetRole, iam:ListRoles, iam:PassRole
Interconnect	All 13 actions (see the Interconnect page)	2 List, 5 Read, 2 Tagging, 4 Write; 0 restricted, 0 conditional	interconnect:AcceptConnectionProposal, interconnect:CreateConnection, interconnect:DeleteConnection, interconnect:DescribeConnectionProposal, interconnect:GetConnection, interconnect:GetEnvironment, interconnect:ListAttachPoints, interconnect:ListConnections, interconnect:ListEnvironments, interconnect:ListTagsForResource, interconnect:TagResource, interconnect:UntagResource and 1 more
CloudWatch Logs	3 of 133	2 List, 1 Read; 0 restricted, 0 conditional	logs:DescribeLogGroups, logs:DescribeLogStreams, logs:GetLogEvents
Network Manager	All 97 actions (see the Network Manager page)	19 List, 3 Permissions management, 20 Read, 2 Tagging, 53 Write; 0 restricted, 0 conditional	networkmanager:*
Route 53	All 71 actions (see the Route 53 page)	22 List, 16 Read, 1 Tagging, 32 Write; 0 restricted, 0 conditional	route53:*
Route 53 Domains	All 36 actions (see the Route 53 Domains page)	3 List, 9 Read, 2 Tagging, 22 Write; 0 restricted, 0 conditional	route53domains:*
S3	2 of 155	2 Read; 0 restricted, 0 conditional	s3:GetBucketLocation, s3:GetBucketWebsite
SNS	3 of 40	2 List, 1 Write; 0 restricted, 0 conditional	sns:CreateTopic, sns:ListSubscriptionsByTopic, sns:ListTopics

EC2 Auto Scaling: 22 actions

autoscaling:DescribeAccountLimits (List)
autoscaling:DescribeAccountSettings (List)
autoscaling:DescribeAdjustmentTypes (List)
autoscaling:DescribeAutoScalingGroups (List)
autoscaling:DescribeAutoScalingInstances (List)
autoscaling:DescribeAutoScalingNotificationTypes (List)
autoscaling:DescribeInstanceRefreshes (List)
autoscaling:DescribeLaunchConfigurations (List)
autoscaling:DescribeLifecycleHookTypes (List)
autoscaling:DescribeLifecycleHooks (List)
autoscaling:DescribeLoadBalancerTargetGroups (List)
autoscaling:DescribeLoadBalancers (List)
autoscaling:DescribeMetricCollectionTypes (List)
autoscaling:DescribeNotificationConfigurations (List)
autoscaling:DescribePolicies (List)
autoscaling:DescribeScalingActivities (List)
autoscaling:DescribeScalingProcessTypes (List)
autoscaling:DescribeScheduledActions (List)
autoscaling:DescribeTags (Read)
autoscaling:DescribeTerminationPolicyTypes (List)
autoscaling:DescribeTrafficSources (List)
autoscaling:DescribeWarmPool (List)

CloudFront: 1 actions

cloudfront:ListDistributions (List)

CloudWatch: 3 actions

cloudwatch:DeleteAlarms (Write)
cloudwatch:DescribeAlarms (Read)
cloudwatch:PutMetricAlarm (Write)

EC2: 201 actions

ec2:AcceptTransitGatewayVpcAttachment (Write)
ec2:AcceptVpcEndpointConnections (Write)
ec2:AcceptVpcPeeringConnection (Write)
ec2:AllocateAddress (Write)
ec2:AssignIpv6Addresses (Write)
ec2:AssignPrivateIpAddresses (Write)
ec2:AssociateAddress (Write)
ec2:AssociateDhcpOptions (Write)
ec2:AssociateRouteTable (Write)
ec2:AssociateSecurityGroupVpc (Write)
ec2:AssociateSubnetCidrBlock (Write)
ec2:AssociateTransitGatewayRouteTable (Write)
ec2:AssociateVpcCidrBlock (Write)
ec2:AttachClassicLinkVpc (Write)
ec2:AttachInternetGateway (Write)
ec2:AttachNetworkInterface (Write)
ec2:AttachVpnGateway (Write)
ec2:AuthorizeSecurityGroupEgress (Write)
ec2:AuthorizeSecurityGroupIngress (Write)
ec2:CreateCarrierGateway (Write)
ec2:CreateCustomerGateway (Write)
ec2:CreateDefaultSubnet (Write)
ec2:CreateDefaultVpc (Write)
ec2:CreateDhcpOptions (Write)
ec2:CreateEgressOnlyInternetGateway (Write)
ec2:CreateFlowLogs (Write)
ec2:CreateInternetGateway (Write)
ec2:CreateLocalGatewayRoute (Write)
ec2:CreateLocalGatewayRouteTableVpcAssociation (Write)
ec2:CreateNatGateway (Write)
ec2:CreateNetworkAcl (Write)
ec2:CreateNetworkAclEntry (Write)
ec2:CreateNetworkInterface (Write)
ec2:CreateNetworkInterfacePermission (Permissions management)
ec2:CreatePlacementGroup (Write)
ec2:CreateRoute (Write)
ec2:CreateRouteTable (Write)
ec2:CreateSecurityGroup (Write)
ec2:CreateSubnet (Write)
ec2:CreateTags (Tagging)
ec2:CreateTransitGateway (Write)
ec2:CreateTransitGatewayRoute (Write)
ec2:CreateTransitGatewayRouteTable (Write)
ec2:CreateTransitGatewayVpcAttachment (Write)
ec2:CreateVpc (Write)
ec2:CreateVpcEndpoint (Write)
ec2:CreateVpcEndpointConnectionNotification (Write)
ec2:CreateVpcEndpointServiceConfiguration (Write)
ec2:CreateVpcPeeringConnection (Write)
ec2:CreateVpnConnection (Write)
ec2:CreateVpnConnectionRoute (Write)
ec2:CreateVpnGateway (Write)
ec2:DeleteCarrierGateway (Write)
ec2:DeleteCustomerGateway (Write)
ec2:DeleteDhcpOptions (Write)
ec2:DeleteEgressOnlyInternetGateway (Write)
ec2:DeleteFlowLogs (Write)
ec2:DeleteInternetGateway (Write)
ec2:DeleteLocalGatewayRoute (Write)
ec2:DeleteLocalGatewayRouteTableVpcAssociation (Write)
ec2:DeleteNatGateway (Write)
ec2:DeleteNetworkAcl (Write)
ec2:DeleteNetworkAclEntry (Write)
ec2:DeleteNetworkInterface (Write)
ec2:DeleteNetworkInterfacePermission (Permissions management)
ec2:DeletePlacementGroup (Write)
ec2:DeleteRoute (Write)
ec2:DeleteRouteTable (Write)
ec2:DeleteSecurityGroup (Write)
ec2:DeleteSubnet (Write)
ec2:DeleteTags (Tagging)
ec2:DeleteTransitGateway (Write)
ec2:DeleteTransitGatewayRoute (Write)
ec2:DeleteTransitGatewayRouteTable (Write)
ec2:DeleteTransitGatewayVpcAttachment (Write)
ec2:DeleteVolume (Write)
ec2:DeleteVpc (Write)
ec2:DeleteVpcEndpointConnectionNotifications (Write)
ec2:DeleteVpcEndpointServiceConfigurations (Write)
ec2:DeleteVpcEndpoints (Write)
ec2:DeleteVpcPeeringConnection (Write)
ec2:DeleteVpnConnection (Write)
ec2:DeleteVpnConnectionRoute (Write)
ec2:DeleteVpnGateway (Write)
ec2:DescribeAccountAttributes (List)
ec2:DescribeAddresses (List)
ec2:DescribeAvailabilityZones (List)
ec2:DescribeCarrierGateways (List)
ec2:DescribeClassicLinkInstances (List)
ec2:DescribeCustomerGateways (List)
ec2:DescribeDhcpOptions (List)
ec2:DescribeEgressOnlyInternetGateways (List)
ec2:DescribeFlowLogs (List)
ec2:DescribeInstances (List)
ec2:DescribeInternetGateways (List)
ec2:DescribeIpv6Pools (List)
ec2:DescribeKeyPairs (List)
ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations (List)
ec2:DescribeLocalGatewayRouteTableVpcAssociations (List)
ec2:DescribeLocalGatewayRouteTables (List)
ec2:DescribeLocalGatewayVirtualInterfaceGroups (List)
ec2:DescribeLocalGatewayVirtualInterfaces (List)
ec2:DescribeLocalGateways (List)
ec2:DescribeMovingAddresses (List)
ec2:DescribeNatGateways (List)
ec2:DescribeNetworkAcls (List)
ec2:DescribeNetworkInterfaceAttribute (List)
ec2:DescribeNetworkInterfacePermissions (List)
ec2:DescribeNetworkInterfaces (List)
ec2:DescribePlacementGroups (List)
ec2:DescribePrefixLists (List)
ec2:DescribePublicIpv4Pools (List)
ec2:DescribeRouteTables (List)
ec2:DescribeSecurityGroupReferences (List)
ec2:DescribeSecurityGroupRules (List)
ec2:DescribeSecurityGroupVpcAssociations (List)
ec2:DescribeSecurityGroups (List)
ec2:DescribeStaleSecurityGroups (List)
ec2:DescribeSubnets (List)
ec2:DescribeTags (List)
ec2:DescribeTransitGatewayAttachments (List)
ec2:DescribeTransitGatewayRouteTables (List)
ec2:DescribeTransitGatewayVpcAttachments (List)
ec2:DescribeTransitGateways (List)
ec2:DescribeVpcAttribute (List)
ec2:DescribeVpcClassicLink (List)
ec2:DescribeVpcClassicLinkDnsSupport (List)
ec2:DescribeVpcEndpointConnectionNotifications (List)
ec2:DescribeVpcEndpointConnections (List)
ec2:DescribeVpcEndpointServiceConfigurations (List)
ec2:DescribeVpcEndpointServicePermissions (List)
ec2:DescribeVpcEndpointServices (List)
ec2:DescribeVpcEndpoints (List)
ec2:DescribeVpcPeeringConnections (List)
ec2:DescribeVpcs (List)
ec2:DescribeVpnConnections (List)
ec2:DescribeVpnGateways (List)
ec2:DetachClassicLinkVpc (Write)
ec2:DetachInternetGateway (Write)
ec2:DetachNetworkInterface (Write)
ec2:DetachVpnGateway (Write)
ec2:DisableTransitGatewayRouteTablePropagation (Write)
ec2:DisableVgwRoutePropagation (Write)
ec2:DisableVpcClassicLink (Write)
ec2:DisableVpcClassicLinkDnsSupport (Write)
ec2:DisassociateAddress (Write)
ec2:DisassociateRouteTable (Write)
ec2:DisassociateSecurityGroupVpc (Write)
ec2:DisassociateSubnetCidrBlock (Write)
ec2:DisassociateTransitGatewayRouteTable (Write)
ec2:DisassociateVpcCidrBlock (Write)
ec2:EnableTransitGatewayRouteTablePropagation (Write)
ec2:EnableVgwRoutePropagation (Write)
ec2:EnableVpcClassicLink (Write)
ec2:EnableVpcClassicLinkDnsSupport (Write)
ec2:ExportTransitGatewayRoutes (Write)
ec2:GetConsoleScreenshot (Read)
ec2:GetSecurityGroupsForVpc (Read)
ec2:GetTransitGatewayAttachmentPropagations (List)
ec2:GetTransitGatewayRouteTableAssociations (List)
ec2:GetTransitGatewayRouteTablePropagations (List)
ec2:GetVpnConnectionDeviceSampleConfiguration (List)
ec2:GetVpnConnectionDeviceTypes (List)
ec2:GetVpnTunnelReplacementStatus (List)
ec2:ModifyNetworkInterfaceAttribute (Write)
ec2:ModifySecurityGroupRules (Write)
ec2:ModifySubnetAttribute (Write)
ec2:ModifyTransitGateway (Write)
ec2:ModifyTransitGatewayVpcAttachment (Write)
ec2:ModifyVpcAttribute (Write)
ec2:ModifyVpcEndpoint (Write)
ec2:ModifyVpcEndpointConnectionNotification (Write)
ec2:ModifyVpcEndpointServiceConfiguration (Write)
ec2:ModifyVpcEndpointServicePermissions (Permissions management)
ec2:ModifyVpcPeeringConnectionOptions (Write)
ec2:ModifyVpcTenancy (Write)
ec2:ModifyVpnConnection (Write)
ec2:ModifyVpnConnectionOptions (Write)
ec2:ModifyVpnTunnelCertificate (Write)
ec2:ModifyVpnTunnelOptions (Write)
ec2:MoveAddressToVpc (Write)
ec2:RejectTransitGatewayVpcAttachment (Write)
ec2:RejectVpcEndpointConnections (Write)
ec2:RejectVpcPeeringConnection (Write)
ec2:ReleaseAddress (Write)
ec2:ReplaceNetworkAclAssociation (Write)
ec2:ReplaceNetworkAclEntry (Write)
ec2:ReplaceRoute (Write)
ec2:ReplaceRouteTableAssociation (Write)
ec2:ReplaceTransitGatewayRoute (Write)
ec2:ReplaceVpnTunnel (Write)
ec2:ResetNetworkInterfaceAttribute (Write)
ec2:RestoreAddressToClassic (Write)
ec2:RevokeSecurityGroupEgress (Write)
ec2:RevokeSecurityGroupIngress (Write)
ec2:SearchLocalGatewayRoutes (List)
ec2:SearchTransitGatewayRoutes (List)
ec2:UnassignIpv6Addresses (Write)
ec2:UnassignPrivateIpAddresses (Write)
ec2:UpdateSecurityGroupRuleDescriptionsEgress (Write)
ec2:UpdateSecurityGroupRuleDescriptionsIngress (Write)

Elastic Beanstalk: 19 actions

elasticbeanstalk:DescribeAccountAttributes (Read)
elasticbeanstalk:DescribeApplicationVersions (List)
elasticbeanstalk:DescribeApplications (List)
elasticbeanstalk:DescribeConfigurationOptions (Read)
elasticbeanstalk:DescribeConfigurationSettings (Read)
elasticbeanstalk:DescribeEnvironmentHealth (Read)
elasticbeanstalk:DescribeEnvironmentManagedActionHistory (Read)
elasticbeanstalk:DescribeEnvironmentManagedActions (Read)
elasticbeanstalk:DescribeEnvironmentResources (Read)
elasticbeanstalk:DescribeEnvironments (List)
elasticbeanstalk:DescribeEvents (Read)
elasticbeanstalk:DescribeInstancesHealth (Read)
elasticbeanstalk:DescribePlatformVersion (Read)
elasticbeanstalk:ListAvailableSolutionStacks (List)
elasticbeanstalk:ListPlatformBranches (List)
elasticbeanstalk:ListPlatformVersions (List)
elasticbeanstalk:ListTagsForResource (Read)
elasticbeanstalk:RequestEnvironmentInfo (Read)
elasticbeanstalk:RetrieveEnvironmentInfo (Read)

IAM: 4 actions

iam:CreateServiceLinkedRole (Write)
iam:GetRole (Read)
iam:ListRoles (List)
iam:PassRole (Write)

CloudWatch Logs: 3 actions

logs:DescribeLogGroups (List)
logs:DescribeLogStreams (List)
logs:GetLogEvents (Read)

S3: 2 actions

s3:GetBucketLocation (Read)
s3:GetBucketWebsite (Read)

SNS: 3 actions

sns:CreateTopic (Write)
sns:ListSubscriptionsByTopic (List)
sns:ListTopics (List)

Data-plane actions (2)

By access level: 1 List, 1 Read.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	1 of 5	1 Read; 0 restricted, 0 conditional	cloudwatch:GetMetricStatistics
S3	1 of 25	1 List; 0 restricted, 0 conditional	s3:ListBucket

CloudWatch: 1 actions

cloudwatch:GetMetricStatistics (Read)

S3: 1 actions

s3:ListBucket (List)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: directconnect (48 of 48), elasticloadbalancing (51 of 51), networkmanager (56 of 56), route53 (32 of 32), route53domains (22 of 22).
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Practical scope

The IAM User Guide says the policy grants permissions to create and maintain network resources in Auto Scaling, Amazon EC2, AWS Direct Connect, Route 53, Amazon CloudFront, Elastic Load Balancing, AWS Elastic Beanstalk, Amazon SNS, CloudWatch, CloudWatch Logs, Amazon S3, IAM and Amazon VPC. The policy document allows directconnect:*, elasticloadbalancing:*, route53:*, route53domains:* and networkmanager:* in full. For IAM it allows iam:GetRole, iam:ListRoles and iam:PassRole only on roles whose names match flow-logs-*, and iam:CreateServiceLinkedRole only when iam:AWSServiceName matches transitgateway.amazonaws.com.

Use cases

The Network administrator job function: a user tasked with setting up and maintaining AWS network resources.
Letting Amazon VPC create and manage logs in CloudWatch Logs on the user's behalf to monitor IP traffic going in and out of a VPC, through a service role named flow-logs-*.

Prerequisites

The flow logs use case needs a role you create yourself. If your users need the optional service role, you must create a role that follows the naming convention in the policy (flow-logs-*) and grant permissions to that role.

Best practices

AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.
The job function policies include filters that limit the names of valid roles that can be passed, which helps avoid granting unnecessary permissions.

Security considerations

The policy grants iam:PassRole, which allows a user to pass a role to an AWS service. In this policy it is limited to roles matching flow-logs-*.
Most statements apply to Resource "*", including delete actions such as ec2:DeleteVpc, ec2:DeleteSecurityGroup and ec2:DeleteVolume, and rule changes such as ec2:AuthorizeSecurityGroupIngress.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity.

Same service

Same domain

Frequently asked questions

When should I attach NetworkAdministrator?: Attach it to a user who is tasked with setting up and maintaining AWS network resources. It is the Network administrator job function, which AWS designed to align with a common job function in the IT industry.
What does NetworkAdministrator grant?: It grants permissions to create and maintain network resources across Auto Scaling, Amazon EC2, AWS Direct Connect, Route 53, Amazon CloudFront, Elastic Load Balancing, AWS Elastic Beanstalk, Amazon SNS, CloudWatch, CloudWatch Logs, Amazon S3, IAM and Amazon VPC. It allows directconnect:*, elasticloadbalancing:*, route53:*, route53domains:* and networkmanager:* in full.
What are the security risks of NetworkAdministrator?: Most of its statements apply to all resources and include create, modify and delete actions for network resources. It allows iam:PassRole, limited to roles named flow-logs-*. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowDefaultNetworkAdminActions",
      "Effect": "Allow",
      "Action": [
        "autoscaling:Describe*",
        "cloudfront:ListDistributions",
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:PutMetricAlarm",
        "directconnect:*",
        "ec2:AcceptVpcEndpointConnections",
        "ec2:AllocateAddress",
        "ec2:AssignIpv6Addresses",
        "ec2:AssignPrivateIpAddresses",
        "ec2:AssociateAddress",
        "ec2:AssociateDhcpOptions",
        "ec2:AssociateRouteTable",
        "ec2:AssociateSubnetCidrBlock",
        "ec2:AssociateVpcCidrBlock",
        "ec2:AttachInternetGateway",
        "ec2:AttachNetworkInterface",
        "ec2:AttachVpnGateway",
        "ec2:CreateCarrierGateway",
        "ec2:CreateCustomerGateway",
        "ec2:CreateDefaultSubnet",
        "ec2:CreateDefaultVpc",
        "ec2:CreateDhcpOptions",
        "ec2:CreateEgressOnlyInternetGateway",
        "ec2:CreateFlowLogs",
        "ec2:CreateInternetGateway",
        "ec2:CreateNatGateway",
        "ec2:CreateNetworkAcl",
        "ec2:CreateNetworkAclEntry",
        "ec2:CreateNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:CreatePlacementGroup",
        "ec2:CreateRoute",
        "ec2:CreateRouteTable",
        "ec2:CreateSecurityGroup",
        "ec2:CreateSubnet",
        "ec2:CreateTags",
        "ec2:CreateVpc",
        "ec2:CreateVpcEndpoint",
        "ec2:CreateVpcEndpointConnectionNotification",
        "ec2:CreateVpcEndpointServiceConfiguration",
        "ec2:CreateVpnConnection",
        "ec2:CreateVpnConnectionRoute",
        "ec2:CreateVpnGateway",
        "ec2:DeleteCarrierGateway",
        "ec2:DeleteEgressOnlyInternetGateway",
        "ec2:DeleteFlowLogs",
        "ec2:DeleteNatGateway",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:DeletePlacementGroup",
        "ec2:DeleteSubnet",
        "ec2:DeleteTags",
        "ec2:DeleteVpc",
        "ec2:DeleteVpcEndpointConnectionNotifications",
        "ec2:DeleteVpcEndpointServiceConfigurations",
        "ec2:DeleteVpcEndpoints",
        "ec2:DeleteVpnConnection",
        "ec2:DeleteVpnConnectionRoute",
        "ec2:DeleteVpnGateway",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeCarrierGateways",
        "ec2:DescribeClassicLinkInstances",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeFlowLogs",
        "ec2:DescribeInstances",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeIpv6Pools",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeMovingAddresses",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNetworkInterfaceAttribute",
        "ec2:DescribeNetworkInterfacePermissions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePlacementGroups",
        "ec2:DescribePrefixLists",
        "ec2:DescribePublicIpv4Pools",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupReferences",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeStaleSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVpcClassicLink",
        "ec2:DescribeVpcClassicLinkDnsSupport",
        "ec2:DescribeVpcEndpointConnectionNotifications",
        "ec2:DescribeVpcEndpointConnections",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpointServicePermissions",
        "ec2:DescribeVpcEndpointServices",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:DetachInternetGateway",
        "ec2:DetachNetworkInterface",
        "ec2:DetachVpnGateway",
        "ec2:DisableVgwRoutePropagation",
        "ec2:DisableVpcClassicLinkDnsSupport",
        "ec2:DisassociateAddress",
        "ec2:DisassociateRouteTable",
        "ec2:DisassociateSubnetCidrBlock",
        "ec2:DisassociateVpcCidrBlock",
        "ec2:EnableVgwRoutePropagation",
        "ec2:EnableVpcClassicLinkDnsSupport",
        "ec2:GetVpnConnectionDeviceSampleConfiguration",
        "ec2:GetVpnConnectionDeviceTypes",
        "ec2:GetVpnTunnelReplacementStatus",
        "ec2:ModifyNetworkInterfaceAttribute",
        "ec2:ModifySecurityGroupRules",
        "ec2:ModifySubnetAttribute",
        "ec2:ModifyVpcAttribute",
        "ec2:ModifyVpcEndpoint",
        "ec2:ModifyVpcEndpointConnectionNotification",
        "ec2:ModifyVpcEndpointServiceConfiguration",
        "ec2:ModifyVpcEndpointServicePermissions",
        "ec2:ModifyVpcPeeringConnectionOptions",
        "ec2:ModifyVpcTenancy",
        "ec2:ModifyVpnConnection",
        "ec2:ModifyVpnConnectionOptions",
        "ec2:ModifyVpnTunnelCertificate",
        "ec2:ModifyVpnTunnelOptions",
        "ec2:MoveAddressToVpc",
        "ec2:RejectVpcEndpointConnections",
        "ec2:ReleaseAddress",
        "ec2:ReplaceNetworkAclAssociation",
        "ec2:ReplaceNetworkAclEntry",
        "ec2:ReplaceRoute",
        "ec2:ReplaceRouteTableAssociation",
        "ec2:ReplaceVpnTunnel",
        "ec2:ResetNetworkInterfaceAttribute",
        "ec2:RestoreAddressToClassic",
        "ec2:UnassignIpv6Addresses",
        "ec2:UnassignPrivateIpAddresses",
        "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
        "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RetrieveEnvironmentInfo",
        "elasticloadbalancing:*",
        "interconnect:AcceptConnectionProposal",
        "interconnect:CreateConnection",
        "interconnect:DeleteConnection",
        "interconnect:DescribeConnectionProposal",
        "interconnect:GetConnection",
        "interconnect:GetEnvironment",
        "interconnect:ListAttachPoints",
        "interconnect:ListConnections",
        "interconnect:ListEnvironments",
        "interconnect:ListTagsForResource",
        "interconnect:TagResource",
        "interconnect:UntagResource",
        "interconnect:UpdateConnection",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:GetLogEvents",
        "route53:*",
        "route53domains:*",
        "sns:CreateTopic",
        "sns:ListSubscriptionsByTopic",
        "sns:ListTopics"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowVPCPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:AcceptVpcPeeringConnection",
        "ec2:AssociateSecurityGroupVpc",
        "ec2:AttachClassicLinkVpc",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateVpcPeeringConnection",
        "ec2:DeleteCustomerGateway",
        "ec2:DeleteDhcpOptions",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteNetworkAcl",
        "ec2:DeleteNetworkAclEntry",
        "ec2:DeleteRoute",
        "ec2:DeleteRouteTable",
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteVolume",
        "ec2:DeleteVpcPeeringConnection",
        "ec2:DescribeSecurityGroupVpcAssociations",
        "ec2:DetachClassicLinkVpc",
        "ec2:DisableVpcClassicLink",
        "ec2:DisassociateSecurityGroupVpc",
        "ec2:EnableVpcClassicLink",
        "ec2:GetConsoleScreenshot",
        "ec2:GetSecurityGroupsForVpc",
        "ec2:RejectVpcPeeringConnection",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowLocalGatewayPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateLocalGatewayRoute",
        "ec2:CreateLocalGatewayRouteTableVpcAssociation",
        "ec2:DeleteLocalGatewayRoute",
        "ec2:DeleteLocalGatewayRouteTableVpcAssociation",
        "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
        "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
        "ec2:DescribeLocalGatewayRouteTables",
        "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
        "ec2:DescribeLocalGatewayVirtualInterfaces",
        "ec2:DescribeLocalGateways",
        "ec2:SearchLocalGatewayRoutes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DiscoverBuckets",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetBucketWebsite",
        "s3:ListBucket"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "DiscoverFlowLogRoles",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListRoles",
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/flow-logs-*"
    },
    {
      "Sid": "NetworkmanagerPermissions",
      "Effect": "Allow",
      "Action": [
        "networkmanager:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TransitGatewayPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:AcceptTransitGatewayVpcAttachment",
        "ec2:AssociateTransitGatewayRouteTable",
        "ec2:CreateTransitGateway",
        "ec2:CreateTransitGatewayRoute",
        "ec2:CreateTransitGatewayRouteTable",
        "ec2:CreateTransitGatewayVpcAttachment",
        "ec2:DeleteTransitGateway",
        "ec2:DeleteTransitGatewayRoute",
        "ec2:DeleteTransitGatewayRouteTable",
        "ec2:DeleteTransitGatewayVpcAttachment",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DisableTransitGatewayRouteTablePropagation",
        "ec2:DisassociateTransitGatewayRouteTable",
        "ec2:EnableTransitGatewayRouteTablePropagation",
        "ec2:ExportTransitGatewayRoutes",
        "ec2:GetTransitGatewayAttachmentPropagations",
        "ec2:GetTransitGatewayRouteTableAssociations",
        "ec2:GetTransitGatewayRouteTablePropagations",
        "ec2:ModifyTransitGateway",
        "ec2:ModifyTransitGatewayVpcAttachment",
        "ec2:RejectTransitGatewayVpcAttachment",
        "ec2:ReplaceTransitGatewayRoute",
        "ec2:SearchTransitGatewayRoutes"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowTransitGatewaySLRCreation",
      "Effect": "Allow",
      "Action": [
        "iam:CreateServiceLinkedRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": [
            "transitgateway.amazonaws.com"
          ]
        }
      }
    }
  ]
}

Version history

Current version v16, edited by AWS on 2026-07-09. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/job-function/NetworkAdministrator
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/job-function/NetworkAdministrator
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/job-function/NetworkAdministrator

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/job-function/NetworkAdministrator

Terraform

resource "aws_iam_role_policy_attachment" "job_function_networkadministrator" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/job-function/NetworkAdministrator"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/NetworkAdministrator"),
);

Sources

NetworkAdministrator (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, securityConsiderations, assignmentGuidance)
AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports practicalScope, useCases, prerequisites, bestPractices, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)