What does ViewOnlyAccess grant?

It grants List*, Describe*, Get*, View* and Lookup* access to resources for AWS services, plus apigateway:GET on a list of Amazon API Gateway resource ARNs.

What are the security risks of ViewOnlyAccess?

It applies to all resources across services, so the user can see what exists throughout the account. AWS says the user cannot read resource content or metadata beyond quota and list information. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

ViewOnlyAccess

OperatorJob functionActiveReviewedShow on map Compare

Summary

A job function policy that AWS describes as granting permissions to view resources and basic metadata across all AWS services. The IAM User Guide describes it as granting List*, Describe*, Get*, View* and Lookup* access to resources for AWS services. The document names actions under 125 service prefixes, so check that the services you use are covered.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN: arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Default version: v48
Created: 2016-11-10
Last edited: 2026-10-30
Services: acm, aiops, amplify, apigateway, appconfig, appsync, athena, autoscaling, aws-marketplace, backup, batch, bedrock, bedrock-agentcore, bedrock-mantle, clouddirectory, cloudformation, cloudfront, cloudsearch, cloudtrail, cloudwatch, codeartifact, codebuild, codecommit, codedeploy, codepipeline, cognito-identity, cognito-idp, cognito-sync, comprehend, config, connect, cost-optimization-hub, databrew, datapipeline, dax, devicefarm, directconnect, discovery, dlm, dms, ds, dynamodb, ec2, ecr, ecs, eks, elasticache, elasticbeanstalk, elasticfilesystem, elasticloadbalancing, elasticmapreduce, elastictranscoder, emr-containers, emr-serverless, es, events, firehose, fsx, gamelift, glacier, glue, greengrass, iam, importexport, inspector, iot, kafka, kendra, kinesis, kinesisanalytics, kms, lambda, lex, lightsail, logs, lookoutvision, m2, machinelearning, mediaconnect, mediastore, memorydb, mobiletargeting, oam, opsworks, opsworks-cm, organizations, outposts, polly, profile, qapps, qbusiness, ram, rds, redshift, redshift-serverless, resource-explorer-2, rolesanywhere, route53, route53domains, route53profiles, route53resolver, s3, sagemaker, sdb, servicecatalog, ses, shield, sns, sqs, ssm, states, storagegateway, swf, tiros, trustedadvisor, uxc, waf, waf-regional, wafv2, wisdom, workdocs, workmail, workspaces, xray

Control-plane actions (1990)

By access level: 1351 List, 638 Read, 1 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Certificate Manager	1 of 42	1 List; 0 restricted, 0 conditional	acm:ListCertificates
AI Operations	5 of 33	3 List, 2 Read; 0 restricted, 0 conditional	aiops:GetInvestigation, aiops:GetInvestigationGroup, aiops:ListInvestigationEvents, aiops:ListInvestigationGroups, aiops:ListInvestigations
Amplify	3 of 41	2 List, 1 Read; 0 restricted, 0 conditional	amplify:GetWebACLForResource, amplify:ListDomainAssociations, amplify:ListResourcesForWebACL
API Gateway	10 of 44	5 List, 5 Read; 1 restricted, 0 conditional	apigateway:GET, apigateway:GetPortal, apigateway:GetPortalProduct, apigateway:GetPortalProductSharingPolicy, apigateway:GetRoutingRule, apigateway:ListPortalProducts, apigateway:ListPortals, apigateway:ListProductPages, apigateway:ListProductRestEndpointPages, apigateway:ListRoutingRules
AppConfig	19 of 56	10 List, 9 Read; 0 restricted, 0 conditional	appconfig:GetAccountSettings, appconfig:GetApplication, appconfig:GetConfigurationProfile, appconfig:GetDeploymentStrategy, appconfig:GetEnvironment, appconfig:GetExperimentDefinition, appconfig:GetExtension, appconfig:GetExtensionAssociation, appconfig:ListApplications, appconfig:ListConfigurationProfiles, appconfig:ListDeploymentStrategies, appconfig:ListDeployments and 7 more
AppSync	6 of 87	6 Read; 0 restricted, 0 conditional	appsync:GetApi, appsync:GetChannelNamespace, appsync:GetGraphqlApi, appsync:GetIntrospectionSchema, appsync:GetResourcePolicy, appsync:GetSourceApiAssociation
Athena	17 of 86	13 List, 4 Read; 0 restricted, 0 conditional	athena:List*
EC2 Auto Scaling	22 of 68	21 List, 1 Read; 0 restricted, 0 conditional	autoscaling:Describe*
Marketplace	1 of 97	1 List; 0 restricted, 0 conditional	aws-marketplace:ViewSubscriptions
Backup	34 of 122	17 List, 17 Read; 0 restricted, 0 conditional	backup:DescribeBackupJob, backup:DescribeBackupVault, backup:DescribeCopyJob, backup:DescribeFramework, backup:DescribeGlobalSettings, backup:DescribeProtectedResource, backup:DescribeRecoveryPoint, backup:DescribeRegionSettings, backup:DescribeReportJob, backup:DescribeReportPlan, backup:DescribeRestoreJob, backup:GetBackupPlan and 22 more
Batch	1 of 46	1 List; 0 restricted, 0 conditional	batch:ListJobs
Bedrock	88 of 232	39 List, 49 Read; 0 restricted, 0 conditional	bedrock:GetAccountDataRetention, bedrock:GetAdvancedPromptOptimizationJob, bedrock:GetAgent, bedrock:GetAgentActionGroup, bedrock:GetAgentAlias, bedrock:GetAgentCollaborator, bedrock:GetAgentKnowledgeBase, bedrock:GetAgentVersion, bedrock:GetAutomatedReasoningPolicy, bedrock:GetAutomatedReasoningPolicyAnnotations, bedrock:GetAutomatedReasoningPolicyBuildWorkflow, bedrock:GetAutomatedReasoningPolicyNextScenario and 76 more
Bedrock-Agentcore	36 of 197	2 List, 34 Read; 0 restricted, 0 conditional	bedrock-agentcore:GatewayGetWebACLForResource, bedrock-agentcore:GatewayListResourcesForWebACL, bedrock-agentcore:GetAgentRuntimeEndpoint, bedrock-agentcore:GetApiKeyCredentialProvider, bedrock-agentcore:GetBrowser, bedrock-agentcore:GetBrowserProfile, bedrock-agentcore:GetCapacityProvider, bedrock-agentcore:GetCodeInterpreter, bedrock-agentcore:GetConfigurationBundle, bedrock-agentcore:GetConfigurationBundleVersion, bedrock-agentcore:GetConsentPortal, bedrock-agentcore:GetEvaluator and 24 more
Bedrock Mantle	15 of 38	8 List, 7 Read; 0 restricted, 0 conditional	bedrock-mantle:CallWithBearerToken, bedrock-mantle:GetAccountDataRetention, bedrock-mantle:GetCustomizedModel, bedrock-mantle:GetFineTuningJob, bedrock-mantle:GetModel, bedrock-mantle:GetProject, bedrock-mantle:GetReservation, bedrock-mantle:ListCustomizedModelAssociations, bedrock-mantle:ListCustomizedModels, bedrock-mantle:ListFiles, bedrock-mantle:ListFineTuningJobs, bedrock-mantle:ListModels and 3 more
Cloud Directory	4 of 66	4 List; 0 restricted, 0 conditional	clouddirectory:ListAppliedSchemaArns, clouddirectory:ListDevelopmentSchemaArns, clouddirectory:ListDirectories, clouddirectory:ListPublishedSchemaArns
CloudFormation	26 of 104	23 List, 3 Read; 0 restricted, 0 conditional	cloudformation:DescribeStacks, cloudformation:GetTemplateSummary, cloudformation:List*
CloudFront	42 of 173	41 List, 1 Read; 0 restricted, 0 conditional	cloudfront:List*
CloudSearch	3 of 32	2 List, 1 Read; 0 restricted, 0 conditional	cloudsearch:DescribeDomains, cloudsearch:List*
CloudTrail	4 of 66	2 List, 2 Read; 0 restricted, 0 conditional	cloudtrail:DescribeTrails, cloudtrail:ListEventDataStores, cloudtrail:ListTrails, cloudtrail:LookupEvents
CloudWatch	60 of 160	24 List, 36 Read; 0 restricted, 0 conditional	cloudwatch:Get, cloudwatch:List
CodeArtifact	2 of 51	2 List; 0 restricted, 0 conditional	codeartifact:ListDomains, codeartifact:ListPackages
CodeBuild	3 of 67	3 List; 0 restricted, 0 conditional	codebuild:ListBuilds*, codebuild:ListProjects
CodeCommit	8 of 91	8 List; 0 restricted, 0 conditional	codecommit:List*
CodeDeploy	25 of 48	17 List, 8 Read; 0 restricted, 0 conditional	codedeploy:BatchGetApplicationRevisions, codedeploy:BatchGetApplications, codedeploy:BatchGetDeploymentGroups, codedeploy:BatchGetDeploymentInstances, codedeploy:BatchGetDeploymentTargets, codedeploy:BatchGetDeployments, codedeploy:BatchGetOnPremisesInstances, codedeploy:Get, codedeploy:List
CodePipeline	1 of 44	1 List; 0 restricted, 0 conditional	codepipeline:ListPipelines
Cognito Identity	3 of 21	2 List, 1 Read; 0 restricted, 0 conditional	cognito-identity:GetPrincipalTagAttributeMap, cognito-identity:ListIdentities, cognito-identity:ListIdentityPools
Cognito User Pools	15 of 139	15 List; 0 restricted, 0 conditional	cognito-idp:List*
Cognito Sync	1 of 19	1 List; 0 restricted, 0 conditional	cognito-sync:ListDatasets
Comprehend	34 of 85	34 Read; 0 restricted, 0 conditional	comprehend:Describe, comprehend:List
Config	33 of 102	18 List, 15 Read; 0 restricted, 0 conditional	config:Describe, config:List
Connect	70 of 388	66 List, 4 Read; 0 restricted, 0 conditional	connect:List*
Cost Optimization Hub	5 of 8	3 List, 2 Read; 0 restricted, 0 conditional	cost-optimization-hub:GetPreferences, cost-optimization-hub:GetRecommendation, cost-optimization-hub:ListEnrollmentStatuses, cost-optimization-hub:ListRecommendationSummaries, cost-optimization-hub:ListRecommendations
DataBrew	2 of 44	2 Read; 0 restricted, 0 conditional	databrew:ListJobs, databrew:ListProjects
Data Pipeline	3 of 21	2 List, 1 Read; 0 restricted, 0 conditional	datapipeline:DescribePipelines, datapipeline:GetAccountLimits, datapipeline:ListPipelines
DynamoDBAccelerator	7 of 30	5 List, 2 Read; 0 restricted, 0 conditional	dax:DescribeClusters, dax:DescribeDefaultParameters, dax:DescribeEvents, dax:DescribeParameterGroups, dax:DescribeParameters, dax:DescribeSubnetGroups, dax:ListTags
Device Farm	24 of 77	24 List; 0 restricted, 0 conditional	devicefarm:List*
Direct Connect	18 of 73	18 Read; 0 restricted, 0 conditional	directconnect:Describe*
Application Discovery	2 of 29	2 List; 0 restricted, 0 conditional	discovery:List*
Data Lifecycle Manager	3 of 8	1 List, 2 Read; 0 restricted, 0 conditional	dlm:GetLifecyclePolicies, dlm:GetLifecyclePolicy, dlm:ListTagsForResource
DMS	9 of 125	9 Read; 0 restricted, 0 conditional	dms:List*
Directory Service	1 of 91	1 List; 0 restricted, 0 conditional	ds:DescribeDirectories
DynamoDB	26 of 68	6 List, 20 Read; 0 restricted, 0 conditional	dynamodb:DescribeBackup, dynamodb:DescribeContinuousBackups, dynamodb:DescribeContributorInsights, dynamodb:DescribeEndpoints, dynamodb:DescribeExport, dynamodb:DescribeGlobalTable, dynamodb:DescribeGlobalTableSettings, dynamodb:DescribeImport, dynamodb:DescribeKinesisStreamingDestination, dynamodb:DescribeLimits, dynamodb:DescribeReservedCapacity, dynamodb:DescribeReservedCapacityOfferings and 14 more
EC2	265 of 834	222 List, 43 Read; 0 restricted, 0 conditional	ec2:DescribeAccountAttributes, ec2:DescribeAccountVpcEncryptionControl, ec2:DescribeAddressTransfers, ec2:DescribeAddresses, ec2:DescribeAddressesAttribute, ec2:DescribeAggregateIdFormat, ec2:DescribeApplicationStatus, ec2:DescribeApplicationStatusCheckAssociations, ec2:DescribeApplicationStatusChecks, ec2:DescribeAvailabilityZones, ec2:DescribeAwsNetworkPerformanceMetricSubscriptions, ec2:DescribeBundleTasks and 200 more
Elastic Container Registry	3 of 65	1 List, 2 Read; 0 restricted, 0 conditional	ecr:DescribeRegistry, ecr:DescribeRepositories, ecr:ListImages
Elastic Container Service	34 of 92	15 List, 19 Read; 0 restricted, 0 conditional	ecs:Describe, ecs:List
EKS	29 of 74	13 List, 16 Read; 0 restricted, 0 conditional	eks:DescribeAccessEntry, eks:DescribeAddon, eks:DescribeAddonConfiguration, eks:DescribeAddonVersions, eks:DescribeCapability, eks:DescribeCluster, eks:DescribeClusterVersions, eks:DescribeEksAnywhereSubscription, eks:DescribeFargateProfile, eks:DescribeIdentityProviderConfig, eks:DescribeInsight, eks:DescribeInsightsRefresh and 17 more
ElastiCache	19 of 77	19 List; 0 restricted, 0 conditional	elasticache:Describe*
Elastic Beanstalk	4 of 50	4 List; 0 restricted, 0 conditional	elasticbeanstalk:DescribeApplicationVersions, elasticbeanstalk:DescribeApplications, elasticbeanstalk:DescribeEnvironments, elasticbeanstalk:ListAvailableSolutionStacks
EFS	1 of 38	1 List; 0 restricted, 0 conditional	elasticfilesystem:DescribeFileSystems
ELB	6 of 77	1 List, 5 Read; 0 restricted, 0 conditional	elasticloadbalancing:DescribeInstanceHealth, elasticloadbalancing:DescribeListeners, elasticloadbalancing:DescribeLoadBalancerAttributes, elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeTargetGroups, elasticloadbalancing:DescribeTargetHealth
EMR	16 of 88	11 List, 5 Read; 0 restricted, 0 conditional	elasticmapreduce:List*
Elastic Transcoder	4 of 17	4 List; 0 restricted, 0 conditional	elastictranscoder:List*
EMR Containers	2 of 25	2 List; 0 restricted, 0 conditional	emr-containers:ListTagsForResource, emr-containers:ListVirtualClusters
EMR Serverless	1 of 25	1 List; 0 restricted, 0 conditional	emr-serverless:ListApplications
OpenSearch Service	3 of 138	2 List, 1 Read; 0 restricted, 0 conditional	es:DescribeElasticsearchDomain, es:DescribeElasticsearchDomains, es:ListDomainNames
EventBridge	3 of 71	3 List; 0 restricted, 0 conditional	events:ListRuleNamesByTarget, events:ListRules, events:ListTargetsByRule
Firehose	3 of 10	2 List, 1 Read; 0 restricted, 0 conditional	firehose:DescribeDeliveryStream, firehose:List*
FSx	1 of 56	1 Read; 0 restricted, 0 conditional	fsx:DescribeFileSystems
GameLift Servers	13 of 121	12 List, 1 Read; 0 restricted, 0 conditional	gamelift:List*
Glacier	9 of 33	6 List, 3 Read; 0 restricted, 0 conditional	glacier:DescribeJob, glacier:GetVaultAccessPolicy, glacier:GetVaultNotifications, glacier:List*
Glue	12 of 306	4 List, 8 Read; 0 restricted, 0 conditional	glue:GetJobRuns, glue:GetResourcePolicies, glue:GetSchema, glue:GetTable, glue:GetTableVersion, glue:GetTableVersions, glue:GetTables, glue:GetTags, glue:ListJobs, glue:ListSchemaVersions, glue:ListSchemas, glue:ListSessions
IoT Greengrass	27 of 112	25 List, 2 Read; 0 restricted, 0 conditional	greengrass:List*
IAM	40 of 190	40 List; 0 restricted, 0 conditional	iam:GetAccountSummary, iam:GetLoginProfile, iam:List*
Import/Export	1 of 6	1 List; 0 restricted, 0 conditional	importexport:ListJobs
Inspector	9 of 37	8 List, 1 Read; 0 restricted, 0 conditional	inspector:List*
IoT	69 of 293	67 List, 1 Read, 1 Write; 0 restricted, 0 conditional	iot:List*
MSK	1 of 64	1 List; 0 restricted, 0 conditional	kafka:ListClusters
Kendra	2 of 66	1 List, 1 Read; 0 restricted, 0 conditional	kendra:ListDataSources, kendra:ListTagsForResource
Kinesis	1 of 42	1 List; 0 restricted, 0 conditional	kinesis:ListStreams
Kinesis Analytics	2 of 34	1 List, 1 Read; 0 restricted, 0 conditional	kinesisanalytics:ListApplications, kinesisanalytics:ListTagsForResource
KMS	2 of 58	2 List; 0 restricted, 0 conditional	kms:ListKeys, kms:ListResourceTags
Lambda	29 of 121	25 List, 4 Read; 0 restricted, 0 conditional	lambda:GetPolicy, lambda:GetProvisionedConcurrencyConfig, lambda:GetResourcePolicy, lambda:List*
Lex	9 of 146	9 List; 0 restricted, 0 conditional	lex:GetBotAliases, lex:GetBotChannelAssociations, lex:GetBotVersions, lex:GetBots, lex:GetIntentVersions, lex:GetIntents, lex:GetSlotTypeVersions, lex:GetSlotTypes, lex:GetUtterancesView
Lightsail	9 of 161	9 Read; 0 restricted, 0 conditional	lightsail:GetBlueprints, lightsail:GetBundles, lightsail:GetInstancePortStates, lightsail:GetInstanceSnapshots, lightsail:GetInstances, lightsail:GetKeyPair, lightsail:GetRegions, lightsail:GetStaticIps, lightsail:IsVpcPeered
CloudWatch Logs	24 of 133	23 List, 1 Read; 0 restricted, 0 conditional	logs:Describe*, logs:GetTransformer, logs:ListEntitiesForLogGroup, logs:ListLogGroupsForEntity, logs:ListLogGroupsForQuery, logs:ListTagsForResource
Lookout Vision	3 of 25	3 List; 0 restricted, 0 conditional	lookoutvision:ListModelPackagingJobs, lookoutvision:ListModels, lookoutvision:ListProjects
Mainframe Modernization	5 of 37	2 List, 3 Read; 0 restricted, 0 conditional	m2:GetApplication, m2:GetEnvironment, m2:ListApplications, m2:ListEnvironments, m2:ListTagsForResource
Machine Learning	5 of 27	5 List; 0 restricted, 0 conditional	machinelearning:Describe*
MediaConnect	7 of 95	7 List; 0 restricted, 0 conditional	mediaconnect:ListEntitlements, mediaconnect:ListFlows, mediaconnect:ListOfferings, mediaconnect:ListReservations, mediaconnect:ListRouterInputs, mediaconnect:ListRouterNetworkInterfaces, mediaconnect:ListRouterOutputs
MediaStore	3 of 26	1 List, 2 Read; 0 restricted, 0 conditional	mediastore:DescribeContainer, mediastore:GetLifecyclePolicy, mediastore:ListTagsForResource
MemoryDB	2 of 47	2 Read; 0 restricted, 0 conditional	memorydb:DescribeAcls, memorydb:DescribeUsers
Pinpoint	4 of 119	4 List; 0 restricted, 0 conditional	mobiletargeting:GetApplicationSettings, mobiletargeting:GetCampaigns, mobiletargeting:GetImportJobs, mobiletargeting:GetSegments
OAM	3 of 15	3 Read; 0 restricted, 0 conditional	oam:ListAttachedLinks, oam:ListLinks, oam:ListSinks
OpsWorks	22 of 74	22 List; 0 restricted, 0 conditional	opsworks:Describe*
OpsworksCM	5 of 19	5 List; 0 restricted, 0 conditional	opsworks-cm:Describe*
Organizations	20 of 63	20 List; 0 restricted, 0 conditional	organizations:List*
Outposts	5 of 44	2 List, 3 Read; 0 restricted, 0 conditional	outposts:GetOutpost, outposts:GetOutpostInstanceTypes, outposts:ListOutposts, outposts:ListSites, outposts:ListTagsForResource
Polly	4 of 13	3 List, 1 Read; 0 restricted, 0 conditional	polly:Describe, polly:List
Profile	2 of 117	2 List; 0 restricted, 0 conditional	profile:ListDomains, profile:ListIntegrations
Q Apps	1 of 21	1 Read; 0 restricted, 0 conditional	qapps:ListTagsForResource
Q Business	7 of 67	7 Read; 0 restricted, 0 conditional	qbusiness:GetApplication, qbusiness:GetDataSource, qbusiness:GetIndex, qbusiness:GetPlugin, qbusiness:GetPolicy, qbusiness:GetRetriever, qbusiness:GetWebExperience
Resource Access Manager	1 of 39	1 Read; 0 restricted, 0 conditional	ram:GetResourceShareAssociations
RDS	49 of 173	47 List, 2 Read; 0 restricted, 0 conditional	rds:Describe*
Redshift	3 of 167	3 List; 0 restricted, 0 conditional	redshift:DescribeClusters, redshift:DescribeEvents, redshift:ViewQueriesInConsole
Redshift Serverless	8 of 69	3 List, 5 Read; 0 restricted, 0 conditional	redshift-serverless:GetCustomDomainAssociation, redshift-serverless:GetEndpointAccess, redshift-serverless:GetNamespace, redshift-serverless:GetRecoveryPoint, redshift-serverless:GetResourcePolicy, redshift-serverless:ListSnapshots, redshift-serverless:ListTagsForResource, redshift-serverless:ListWorkgroups
Resource Explorer	6 of 37	3 List, 3 Read; 0 restricted, 0 conditional	resource-explorer-2:GetDefaultView, resource-explorer-2:GetIndex, resource-explorer-2:ListIndexes, resource-explorer-2:ListSupportedResourceTypes, resource-explorer-2:ListTagsForResource, resource-explorer-2:ListViews
IAM Roles Anywhere	5 of 30	5 List; 0 restricted, 0 conditional	rolesanywhere:ListCrls, rolesanywhere:ListProfiles, rolesanywhere:ListSubjects, rolesanywhere:ListTagsForResource, rolesanywhere:ListTrustAnchors
Route 53	37 of 71	22 List, 15 Read; 0 restricted, 0 conditional	route53:Get, route53:List
Route 53 Domains	4 of 36	3 List, 1 Read; 0 restricted, 0 conditional	route53domains:List*
Route 53 Profiles	7 of 19	4 List, 3 Read; 0 restricted, 0 conditional	route53profiles:GetProfile, route53profiles:GetProfileAssociation, route53profiles:GetProfileResourceAssociation, route53profiles:ListProfileAssociations, route53profiles:ListProfileResourceAssociations, route53profiles:ListProfiles, route53profiles:ListTagsForResource
Route 53 Resolver	32 of 70	16 List, 16 Read; 0 restricted, 0 conditional	route53resolver:Get, route53resolver:List
S3	2 of 155	2 List; 0 restricted, 0 conditional	s3:ListAllMyBuckets, s3:ListMultiRegionAccessPoints
SageMaker	175 of 441	95 List, 80 Read; 0 restricted, 0 conditional	sagemaker:Describe, sagemaker:List
SimpleDB	2 of 13	2 List; 0 restricted, 0 conditional	sdb:List*
Service Catalog	24 of 117	23 List, 1 Read; 0 restricted, 0 conditional	servicecatalog:List*
SES	39 of 231	31 List, 8 Read; 0 restricted, 0 conditional	ses:DescribeActiveReceiptRuleSet, ses:List*, ses:ListDedicatedIpPools
Shield	6 of 40	5 List, 1 Read; 0 restricted, 0 conditional	shield:List*
SNS	11 of 40	7 List, 4 Read; 0 restricted, 0 conditional	sns:GetDataProtectionPolicy, sns:GetSubscriptionAttributes, sns:List*
SQS	6 of 20	6 Read; 0 restricted, 0 conditional	sqs:GetQueueAttributes, sqs:GetQueueUrl, sqs:ListDeadLetterSourceQueues, sqs:ListMessageMoveTasks, sqs:ListQueueTags, sqs:ListQueues
Systems Manager	2 of 164	2 List; 0 restricted, 0 conditional	ssm:ListAssociations, ssm:ListDocuments
Step Functions	6 of 37	6 List; 0 restricted, 0 conditional	states:ListActivities, states:ListExecutions, states:ListMapRuns, states:ListStateMachineAliases, states:ListStateMachineVersions, states:ListStateMachines
Storage Gateway	5 of 97	4 List, 1 Read; 0 restricted, 0 conditional	storagegateway:DescribeSMBSettings, storagegateway:ListGateways, storagegateway:ListLocalDisks, storagegateway:ListVolumeRecoveryPoints, storagegateway:ListVolumes
SWF	4 of 32	4 List; 0 restricted, 0 conditional	swf:List*
Tiros	3 of 5	3 Read; 0 restricted, 0 conditional	tiros:GetQueryAnswer, tiros:GetQueryExplanation, tiros:GetQueryExtensionAccounts
Trusted Advisor	16 of 42	16 Read; 0 restricted, 0 conditional	trustedadvisor:Describe*
User Experience Customization (UXC)	1 of 4	1 Read; 0 restricted, 0 conditional	uxc:ListServices
WAF	16 of 77	15 List, 1 Read; 0 restricted, 0 conditional	waf:List*
WAF Regional	17 of 81	16 List, 1 Read; 0 restricted, 0 conditional	waf-regional:List*
WAF V2	13 of 64	12 List, 1 Read; 0 restricted, 0 conditional	wafv2:List*
Q in Connect	1 of 97	1 List; 0 restricted, 0 conditional	wisdom:ListAssistants
WorkDocs	2 of 61	2 List; 0 restricted, 0 conditional	workdocs:DescribeAvailableDirectories, workdocs:DescribeInstances
WorkMail	13 of 126	5 List, 8 Read; 0 restricted, 0 conditional	workmail:Describe*
WorkSpaces	25 of 103	13 List, 12 Read; 0 restricted, 0 conditional	workspaces:Describe*
X-Ray	6 of 32	1 List, 5 Read; 0 restricted, 0 conditional	xray:GetEncryptionConfig, xray:GetGroups, xray:GetSamplingRules, xray:GetSamplingStatisticSummaries, xray:GetTraceSegmentDestination, xray:ListResourcePolicies

The full action list is in actions.json.

Data-plane actions (21)

By access level: 9 List, 12 Read.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
Bedrock	6 of 37	3 List, 3 Read; 0 restricted, 0 conditional	bedrock:GetAsyncInvoke, bedrock:GetDataAutomationStatus, bedrock:GetIngestedDocumentAcl, bedrock:ListInvocationSteps, bedrock:ListInvocations, bedrock:ListSessions
Bedrock-Agentcore	3 of 62	3 Read; 0 restricted, 0 conditional	bedrock-agentcore:GetAgentCard, bedrock-agentcore:GetCodeInterpreterSession, bedrock-agentcore:GetPaymentSession
CloudWatch	4 of 5	1 List, 3 Read; 0 restricted, 0 conditional	cloudwatch:Get, cloudwatch:List
Q Apps	2 of 18	1 List, 1 Read; 0 restricted, 0 conditional	qapps:GetQApp, qapps:ListQApps
S3	1 of 25	1 List; 0 restricted, 0 conditional	s3:ListBucket
SageMaker	1 of 19	1 List; 0 restricted, 0 conditional	sagemaker:List*
SWF	2 of 19	2 List; 0 restricted, 0 conditional	swf:List*
User Experience Customization (UXC)	1 of 2	1 Read; 0 restricted, 0 conditional	uxc:GetAccountCustomizations
X-Ray	1 of 12	1 Read; 0 restricted, 0 conditional	xray:GetSamplingTargets

The full action list is in actions.json.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 1 write, tagging or permissions-management action, short of full control of any service.

Guidance

Practical scope

The GeneralViewOnlyAccessStatement statement applies to Resource "*". A second statement, APIGatewayAccess, allows apigateway:GET on a list of Amazon API Gateway resource ARNs. AWS says the user can view a list of AWS resources and basic metadata in the account across services, but cannot read resource content or metadata that goes beyond the quota and list information for resources.

Use cases

View a list of AWS resources and basic metadata in the account across services (the View-only user job function).

Best practices

AWS managed policies don't grant least privilege permissions. The IAM User Guide suggests using IAM Access Analyzer to see which permissions principals actually use, then writing a custom policy or generating one with only the required permissions.

Security considerations

The first statement applies to all resources across services, so it exposes resource lists and basic metadata account-wide, even though AWS says it does not read resource content.
In the IAM User Guide, ReadOnlyAccess points to ViewOnlyAccess as the option that doesn't grant access to read data in storage services.
You cannot change the permissions in an AWS managed policy. If AWS updates the policy, the update affects every user, group and role it is attached to.

Assignment guidance

You can attach this policy to your users, groups and roles. The reference page also links to guidance on creating a permission set using AWS managed policies in IAM Identity Center. AWS says you can attach job function policies to any IAM identity. It fits where a user only needs to see what exists in the account. Where a user must read stored data, AWS describes ReadOnlyAccess instead.

Same service

Same domain

Frequently asked questions

When should I attach ViewOnlyAccess?: Attach it for a user who needs to view a list of AWS resources and basic metadata in the account across services. It is the View-only user job function.
What does ViewOnlyAccess grant?: It grants List*, Describe*, Get*, View* and Lookup* access to resources for AWS services, plus apigateway:GET on a list of Amazon API Gateway resource ARNs.
What are the security risks of ViewOnlyAccess?: It applies to all resources across services, so the user can see what exists throughout the account. AWS says the user cannot read resource content or metadata beyond quota and list information. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "GeneralViewOnlyAccessStatement",
      "Effect": "Allow",
      "Action": [
        "acm:ListCertificates",
        "aiops:GetInvestigation",
        "aiops:GetInvestigationGroup",
        "aiops:ListInvestigationEvents",
        "aiops:ListInvestigationGroups",
        "aiops:ListInvestigations",
        "amplify:GetWebACLForResource",
        "amplify:ListDomainAssociations",
        "amplify:ListResourcesForWebACL",
        "apigateway:GetPortal",
        "apigateway:GetPortalProduct",
        "apigateway:GetPortalProductSharingPolicy",
        "apigateway:GetRoutingRule",
        "apigateway:ListPortalProducts",
        "apigateway:ListPortals",
        "apigateway:ListProductPages",
        "apigateway:ListProductRestEndpointPages",
        "apigateway:ListRoutingRules",
        "appconfig:GetAccountSettings",
        "appconfig:GetApplication",
        "appconfig:GetConfigurationProfile",
        "appconfig:GetDeploymentStrategy",
        "appconfig:GetEnvironment",
        "appconfig:GetExperimentDefinition",
        "appconfig:GetExtension",
        "appconfig:GetExtensionAssociation",
        "appconfig:ListApplications",
        "appconfig:ListConfigurationProfiles",
        "appconfig:ListDeploymentStrategies",
        "appconfig:ListDeployments",
        "appconfig:ListEnvironments",
        "appconfig:ListExperimentDefinitions",
        "appconfig:ListExperimentRuns",
        "appconfig:ListExtensionAssociations",
        "appconfig:ListExtensions",
        "appconfig:ListHostedConfigurationVersions",
        "appconfig:ListTagsForResource",
        "appsync:GetApi",
        "appsync:GetChannelNamespace",
        "appsync:GetGraphqlApi",
        "appsync:GetIntrospectionSchema",
        "appsync:GetResourcePolicy",
        "appsync:GetSourceApiAssociation",
        "athena:List*",
        "autoscaling:Describe*",
        "aws-marketplace:ViewSubscriptions",
        "backup:DescribeBackupJob",
        "backup:DescribeBackupVault",
        "backup:DescribeCopyJob",
        "backup:DescribeFramework",
        "backup:DescribeGlobalSettings",
        "backup:DescribeProtectedResource",
        "backup:DescribeRecoveryPoint",
        "backup:DescribeRegionSettings",
        "backup:DescribeReportJob",
        "backup:DescribeReportPlan",
        "backup:DescribeRestoreJob",
        "backup:GetBackupPlan",
        "backup:GetBackupPlanFromJSON",
        "backup:GetBackupPlanFromTemplate",
        "backup:GetBackupSelection",
        "backup:GetSupportedResourceTypes",
        "backup:ListBackupJobs",
        "backup:ListBackupPlanTemplates",
        "backup:ListBackupPlanVersions",
        "backup:ListBackupPlans",
        "backup:ListBackupSelections",
        "backup:ListBackupVaults",
        "backup:ListCopyJobs",
        "backup:ListFrameworks",
        "backup:ListLegalHolds",
        "backup:ListProtectedResources",
        "backup:ListProtectedResourcesByBackupVault",
        "backup:ListRecoveryPointsByBackupVault",
        "backup:ListRecoveryPointsByLegalHold",
        "backup:ListRecoveryPointsByResource",
        "backup:ListReportJobs",
        "backup:ListReportPlans",
        "backup:ListRestoreJobs",
        "backup:ListTags",
        "batch:ListJobs",
        "bedrock-agentcore:GatewayGetWebACLForResource",
        "bedrock-agentcore:GatewayListResourcesForWebACL",
        "bedrock-agentcore:GetAgentCard",
        "bedrock-agentcore:GetAgentRuntimeEndpoint",
        "bedrock-agentcore:GetApiKeyCredentialProvider",
        "bedrock-agentcore:GetBrowser",
        "bedrock-agentcore:GetBrowserProfile",
        "bedrock-agentcore:GetCapacityProvider",
        "bedrock-agentcore:GetCodeInterpreter",
        "bedrock-agentcore:GetCodeInterpreterSession",
        "bedrock-agentcore:GetConfigurationBundle",
        "bedrock-agentcore:GetConfigurationBundleVersion",
        "bedrock-agentcore:GetConsentPortal",
        "bedrock-agentcore:GetEvaluator",
        "bedrock-agentcore:GetGateway",
        "bedrock-agentcore:GetGatewayRateLimit",
        "bedrock-agentcore:GetGatewayRule",
        "bedrock-agentcore:GetGatewayTarget",
        "bedrock-agentcore:GetHarnessEndpoint",
        "bedrock-agentcore:GetMemory",
        "bedrock-agentcore:GetOauth2CredentialProvider",
        "bedrock-agentcore:GetOnlineEvaluationConfig",
        "bedrock-agentcore:GetPaymentConnector",
        "bedrock-agentcore:GetPaymentCredentialProvider",
        "bedrock-agentcore:GetPaymentManager",
        "bedrock-agentcore:GetPaymentSession",
        "bedrock-agentcore:GetPolicy",
        "bedrock-agentcore:GetPolicyEngine",
        "bedrock-agentcore:GetPolicyEngineSummary",
        "bedrock-agentcore:GetPolicyGeneration",
        "bedrock-agentcore:GetPolicyGenerationSummary",
        "bedrock-agentcore:GetPolicySummary",
        "bedrock-agentcore:GetRegistry",
        "bedrock-agentcore:GetRegistryRecord",
        "bedrock-agentcore:GetResourcePolicy",
        "bedrock-agentcore:GetTokenVault",
        "bedrock-agentcore:ListApiKeyCredentialProviders",
        "bedrock-agentcore:ListOauth2CredentialProviders",
        "bedrock-agentcore:ListTagsForResource",
        "bedrock-mantle:CallWithBearerToken",
        "bedrock-mantle:GetAccountDataRetention",
        "bedrock-mantle:GetCustomizedModel",
        "bedrock-mantle:GetFineTuningJob",
        "bedrock-mantle:GetModel",
        "bedrock-mantle:GetProject",
        "bedrock-mantle:GetReservation",
        "bedrock-mantle:ListCustomizedModelAssociations",
        "bedrock-mantle:ListCustomizedModels",
        "bedrock-mantle:ListFiles",
        "bedrock-mantle:ListFineTuningJobs",
        "bedrock-mantle:ListModels",
        "bedrock-mantle:ListProjects",
        "bedrock-mantle:ListReservations",
        "bedrock-mantle:ListTagsForResource",
        "bedrock:GetAccountDataRetention",
        "bedrock:GetAdvancedPromptOptimizationJob",
        "bedrock:GetAgent",
        "bedrock:GetAgentActionGroup",
        "bedrock:GetAgentAlias",
        "bedrock:GetAgentCollaborator",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:GetAgentVersion",
        "bedrock:GetAsyncInvoke",
        "bedrock:GetAutomatedReasoningPolicy",
        "bedrock:GetAutomatedReasoningPolicyAnnotations",
        "bedrock:GetAutomatedReasoningPolicyBuildWorkflow",
        "bedrock:GetAutomatedReasoningPolicyNextScenario",
        "bedrock:GetBlueprint",
        "bedrock:GetBlueprintOptimizationStatus",
        "bedrock:GetBlueprintRecommendation",
        "bedrock:GetCustomModel",
        "bedrock:GetCustomModelDeployment",
        "bedrock:GetDataAutomationLibrary",
        "bedrock:GetDataAutomationLibraryIngestionJob",
        "bedrock:GetDataAutomationProject",
        "bedrock:GetDataAutomationStatus",
        "bedrock:GetDataSource",
        "bedrock:GetEvaluationJob",
        "bedrock:GetExecutionFlowSnapshot",
        "bedrock:GetFlow",
        "bedrock:GetFlowAlias",
        "bedrock:GetFlowExecution",
        "bedrock:GetFlowVersion",
        "bedrock:GetFoundationModel",
        "bedrock:GetFoundationModelAvailability",
        "bedrock:GetGuardrail",
        "bedrock:GetImportedModel",
        "bedrock:GetInferenceProfile",
        "bedrock:GetIngestedDocumentAcl",
        "bedrock:GetIngestionJob",
        "bedrock:GetKnowledgeBase",
        "bedrock:GetKnowledgeBaseDocuments",
        "bedrock:GetMarketplaceModelEndpoint",
        "bedrock:GetModelCopyJob",
        "bedrock:GetModelCustomizationJob",
        "bedrock:GetModelEvaluationJob",
        "bedrock:GetModelImportJob",
        "bedrock:GetModelInvocationJob",
        "bedrock:GetModelInvocationLoggingConfiguration",
        "bedrock:GetPromptRouter",
        "bedrock:GetProvisionedModelThroughput",
        "bedrock:GetResourcePolicy",
        "bedrock:GetUseCaseForModelAccess",
        "bedrock:ListAdvancedPromptOptimizationJobs",
        "bedrock:ListAgentActionGroups",
        "bedrock:ListAgentAliases",
        "bedrock:ListAgentCollaborators",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:ListAgentVersions",
        "bedrock:ListAgents",
        "bedrock:ListAsyncInvokes",
        "bedrock:ListAutomatedReasoningPolicies",
        "bedrock:ListAutomatedReasoningPolicyBuildWorkflows",
        "bedrock:ListBlueprints",
        "bedrock:ListCustomModelDeployments",
        "bedrock:ListCustomModels",
        "bedrock:ListDataAutomationLibraries",
        "bedrock:ListDataAutomationLibraryEntities",
        "bedrock:ListDataAutomationLibraryIngestionJobs",
        "bedrock:ListDataAutomationProjects",
        "bedrock:ListDataSources",
        "bedrock:ListEnforcedGuardrailsConfiguration",
        "bedrock:ListEvaluationJobs",
        "bedrock:ListFlowAliases",
        "bedrock:ListFlowExecutions",
        "bedrock:ListFlowVersions",
        "bedrock:ListFlows",
        "bedrock:ListFoundationModelAgreementOffers",
        "bedrock:ListFoundationModels",
        "bedrock:ListGuardrails",
        "bedrock:ListImportedModels",
        "bedrock:ListInferenceProfiles",
        "bedrock:ListIngestionJobs",
        "bedrock:ListInvocationSteps",
        "bedrock:ListInvocations",
        "bedrock:ListKnowledgeBaseDocuments",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListMarketplaceModelEndpoints",
        "bedrock:ListModelCopyJobs",
        "bedrock:ListModelCustomizationJobs",
        "bedrock:ListModelImportJobs",
        "bedrock:ListModelInvocationJobs",
        "bedrock:ListPromptRouters",
        "bedrock:ListPrompts",
        "bedrock:ListProvisionedModelThroughputs",
        "bedrock:ListSessions",
        "bedrock:ListTagsForResource",
        "bedrock:ValidateFlowDefinition",
        "clouddirectory:ListAppliedSchemaArns",
        "clouddirectory:ListDevelopmentSchemaArns",
        "clouddirectory:ListDirectories",
        "clouddirectory:ListPublishedSchemaArns",
        "cloudformation:DescribeStacks",
        "cloudformation:GetTemplateSummary",
        "cloudformation:List*",
        "cloudfront:List*",
        "cloudsearch:DescribeDomains",
        "cloudsearch:List*",
        "cloudtrail:DescribeTrails",
        "cloudtrail:ListEventDataStores",
        "cloudtrail:ListTrails",
        "cloudtrail:LookupEvents",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "codeartifact:ListDomains",
        "codeartifact:ListPackages",
        "codebuild:ListBuilds*",
        "codebuild:ListProjects",
        "codecommit:List*",
        "codedeploy:BatchGetApplicationRevisions",
        "codedeploy:BatchGetApplications",
        "codedeploy:BatchGetDeploymentGroups",
        "codedeploy:BatchGetDeploymentInstances",
        "codedeploy:BatchGetDeploymentTargets",
        "codedeploy:BatchGetDeployments",
        "codedeploy:BatchGetOnPremisesInstances",
        "codedeploy:Get*",
        "codedeploy:List*",
        "codepipeline:ListPipelines",
        "codestar:List*",
        "cognito-identity:GetPrincipalTagAttributeMap",
        "cognito-identity:ListIdentities",
        "cognito-identity:ListIdentityPools",
        "cognito-idp:List*",
        "cognito-sync:ListDatasets",
        "comprehend:Describe*",
        "comprehend:List*",
        "config:Describe*",
        "config:List*",
        "connect:List*",
        "cost-optimization-hub:GetPreferences",
        "cost-optimization-hub:GetRecommendation",
        "cost-optimization-hub:ListEnrollmentStatuses",
        "cost-optimization-hub:ListRecommendationSummaries",
        "cost-optimization-hub:ListRecommendations",
        "databrew:ListJobs",
        "databrew:ListProjects",
        "datapipeline:DescribePipelines",
        "datapipeline:GetAccountLimits",
        "datapipeline:ListPipelines",
        "dax:DescribeClusters",
        "dax:DescribeDefaultParameters",
        "dax:DescribeEvents",
        "dax:DescribeParameterGroups",
        "dax:DescribeParameters",
        "dax:DescribeSubnetGroups",
        "dax:ListTags",
        "devicefarm:List*",
        "directconnect:Describe*",
        "discovery:List*",
        "dlm:GetLifecyclePolicies",
        "dlm:GetLifecyclePolicy",
        "dlm:ListTagsForResource",
        "dms:List*",
        "ds:DescribeDirectories",
        "dynamodb:DescribeBackup",
        "dynamodb:DescribeContinuousBackups",
        "dynamodb:DescribeContributorInsights",
        "dynamodb:DescribeEndpoints",
        "dynamodb:DescribeExport",
        "dynamodb:DescribeGlobalTable",
        "dynamodb:DescribeGlobalTableSettings",
        "dynamodb:DescribeImport",
        "dynamodb:DescribeKinesisStreamingDestination",
        "dynamodb:DescribeLimits",
        "dynamodb:DescribeReservedCapacity",
        "dynamodb:DescribeReservedCapacityOfferings",
        "dynamodb:DescribeStream",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeTableReplicaAutoScaling",
        "dynamodb:DescribeTimeToLive",
        "dynamodb:GetAbacStatus",
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListBackups",
        "dynamodb:ListContributorInsights",
        "dynamodb:ListExports",
        "dynamodb:ListGlobalTables",
        "dynamodb:ListImports",
        "dynamodb:ListStreams",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAccountVpcEncryptionControl",
        "ec2:DescribeAddressTransfers",
        "ec2:DescribeAddresses",
        "ec2:DescribeAddressesAttribute",
        "ec2:DescribeAggregateIdFormat",
        "ec2:DescribeApplicationStatus",
        "ec2:DescribeApplicationStatusCheckAssociations",
        "ec2:DescribeApplicationStatusChecks",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeAwsNetworkPerformanceMetricSubscriptions",
        "ec2:DescribeBundleTasks",
        "ec2:DescribeByoipCidrs",
        "ec2:DescribeCapacityBlockExtensionHistory",
        "ec2:DescribeCapacityBlockExtensionOfferings",
        "ec2:DescribeCapacityBlockOfferings",
        "ec2:DescribeCapacityBlockStatus",
        "ec2:DescribeCapacityBlocks",
        "ec2:DescribeCapacityManagerDataExports",
        "ec2:DescribeCapacityReservationBillingRequests",
        "ec2:DescribeCapacityReservationCancellationQuotes",
        "ec2:DescribeCapacityReservationFleets",
        "ec2:DescribeCapacityReservationTopology",
        "ec2:DescribeCapacityReservations",
        "ec2:DescribeCarrierGateways",
        "ec2:DescribeClassicLinkInstances",
        "ec2:DescribeClientVpnAuthorizationRules",
        "ec2:DescribeClientVpnConnections",
        "ec2:DescribeClientVpnEndpoints",
        "ec2:DescribeClientVpnRoutes",
        "ec2:DescribeClientVpnTargetNetworks",
        "ec2:DescribeCoipPools",
        "ec2:DescribeConversionTasks",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeDeclarativePoliciesReports",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeElasticGpus",
        "ec2:DescribeExportImageTasks",
        "ec2:DescribeExportTasks",
        "ec2:DescribeFastLaunchImages",
        "ec2:DescribeFastSnapshotRestores",
        "ec2:DescribeFleetHistory",
        "ec2:DescribeFleetInstances",
        "ec2:DescribeFleets",
        "ec2:DescribeFlowLogs",
        "ec2:DescribeFpgaImageAttribute",
        "ec2:DescribeFpgaImages",
        "ec2:DescribeHost*",
        "ec2:DescribeIamInstanceProfileAssociations",
        "ec2:DescribeIdFormat",
        "ec2:DescribeIdentityIdFormat",
        "ec2:DescribeImage*",
        "ec2:DescribeImport*",
        "ec2:DescribeInstance*",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeIpamByoasn",
        "ec2:DescribeIpamExternalResourceVerificationTokens",
        "ec2:DescribeIpamInternetRegistryAssociations",
        "ec2:DescribeIpamPolicies",
        "ec2:DescribeIpamPoolAllocations",
        "ec2:DescribeIpamPools",
        "ec2:DescribeIpamPrefixListResolverTargets",
        "ec2:DescribeIpamPrefixListResolvers",
        "ec2:DescribeIpamResourceDiscoveries",
        "ec2:DescribeIpamResourceDiscoveryAssociations",
        "ec2:DescribeIpamScopes",
        "ec2:DescribeIpams",
        "ec2:DescribeIpv6Pools",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeLaunchTemplateVersions",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeLocalGatewayRouteTablePermissions",
        "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
        "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
        "ec2:DescribeLocalGatewayRouteTables",
        "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
        "ec2:DescribeLocalGatewayVirtualInterfaces",
        "ec2:DescribeLocalGateways",
        "ec2:DescribeLockedSnapshots",
        "ec2:DescribeMacHosts",
        "ec2:DescribeMacModificationTasks",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeMovingAddresses",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetwork*",
        "ec2:DescribeOutpostLags",
        "ec2:DescribePlacementGroups",
        "ec2:DescribePrefixLists",
        "ec2:DescribePrincipalIdFormat",
        "ec2:DescribePublicIpv4Pools",
        "ec2:DescribeRegions",
        "ec2:DescribeReplaceRootVolumeTasks",
        "ec2:DescribeReserved*",
        "ec2:DescribeRouteServerEndpoints",
        "ec2:DescribeRouteServerPeers",
        "ec2:DescribeRouteServers",
        "ec2:DescribeRouteTables",
        "ec2:DescribeScheduledInstanceAvailability",
        "ec2:DescribeScheduledInstances",
        "ec2:DescribeSecondaryInterfaces",
        "ec2:DescribeSecondaryNetworks",
        "ec2:DescribeSecondarySubnets",
        "ec2:DescribeSecurityGroupReferences",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroupVpcAssociations",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeServiceLinkVirtualInterfaces",
        "ec2:DescribeSnapshot*",
        "ec2:DescribeSpot*",
        "ec2:DescribeStaleSecurityGroups",
        "ec2:DescribeStoreImageTasks",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeTrafficMirrorFilterRules",
        "ec2:DescribeTrafficMirrorFilters",
        "ec2:DescribeTrafficMirrorSessions",
        "ec2:DescribeTrafficMirrorTargets",
        "ec2:DescribeTransitGatewayAttachments",
        "ec2:DescribeTransitGatewayConnectPeers",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayMeteringPolicies",
        "ec2:DescribeTransitGatewayMulticastDomains",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayPolicyTables",
        "ec2:DescribeTransitGatewayRouteTableAnnouncements",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeTrunkInterfaceAssociations",
        "ec2:DescribeVerifiedAccessEndpoints",
        "ec2:DescribeVerifiedAccessGroups",
        "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
        "ec2:DescribeVerifiedAccessInstanceWebAclAssociations",
        "ec2:DescribeVerifiedAccessInstances",
        "ec2:DescribeVerifiedAccessTrustProviders",
        "ec2:DescribeVolume*",
        "ec2:DescribeVpc*",
        "ec2:DescribeVpnConcentrators",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetActiveVpnTunnelStatus",
        "ec2:GetAllowedImagesSettings",
        "ec2:GetAssociatedEnclaveCertificateIamRoles",
        "ec2:GetAssociatedIpv6PoolCidrs",
        "ec2:GetCapacityManagerAttributes",
        "ec2:GetCapacityManagerMetricDimensions",
        "ec2:GetCapacityManagerMonitoredTagKeys",
        "ec2:GetCapacityReservationUsage",
        "ec2:GetCoipPoolUsage",
        "ec2:GetDeclarativePoliciesReportSummary",
        "ec2:GetDefaultCreditSpecification",
        "ec2:GetEbsDefaultKmsKeyId",
        "ec2:GetEbsEncryptionByDefault",
        "ec2:GetEnabledIpamPolicy",
        "ec2:GetFlowLogsIntegrationTemplate",
        "ec2:GetGroupsForCapacityReservation",
        "ec2:GetHostReservationPurchasePreview",
        "ec2:GetImageAncestry",
        "ec2:GetImageBlockPublicAccessState",
        "ec2:GetInstanceMetadataDefaults",
        "ec2:GetInstanceTypesFromInstanceRequirements",
        "ec2:GetIpamAddressHistory",
        "ec2:GetIpamDiscoveredAccounts",
        "ec2:GetIpamDiscoveredResourceCidrs",
        "ec2:GetIpamDiscoveredRoutes",
        "ec2:GetIpamInternetRegistryAssociationAsns",
        "ec2:GetIpamInternetRegistryAssociationCidrs",
        "ec2:GetIpamPolicyAllocationRules",
        "ec2:GetIpamPolicyOrganizationTargets",
        "ec2:GetIpamPoolCidrs",
        "ec2:GetIpamPrefixListResolverRules",
        "ec2:GetIpamPrefixListResolverVersions",
        "ec2:GetIpamResourceCidrs",
        "ec2:GetIpamRouteOriginAuthorizations",
        "ec2:GetIpamRouteProtectionFindings",
        "ec2:GetIpamRoutingPolicyRegistrations",
        "ec2:GetManagedPrefixListAssociations",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetManagedResourceVisibility",
        "ec2:GetNetworkInsightsAccessScopeAnalysisFindings",
        "ec2:GetNetworkInsightsAccessScopeContent",
        "ec2:GetReservedInstancesExchangeQuote",
        "ec2:GetResourcePolicy",
        "ec2:GetRouteServerAssociations",
        "ec2:GetRouteServerPropagations",
        "ec2:GetSecurityGroupsForVpc",
        "ec2:GetSerialConsoleAccessStatus",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ec2:GetSpotPlacementScores",
        "ec2:GetSubnetCidrReservations",
        "ec2:GetTransitGatewayAttachmentPropagations",
        "ec2:GetTransitGatewayMeteringPolicyEntries",
        "ec2:GetTransitGatewayMulticastDomainAssociations",
        "ec2:GetTransitGatewayPolicyTableAssociations",
        "ec2:GetTransitGatewayPolicyTableEntries",
        "ec2:GetTransitGatewayPrefixListReferences",
        "ec2:GetTransitGatewayRouteTableAssociations",
        "ec2:GetTransitGatewayRouteTablePropagations",
        "ec2:GetVerifiedAccessEndpointPolicy",
        "ec2:GetVerifiedAccessEndpointTargets",
        "ec2:GetVerifiedAccessGroupPolicy",
        "ec2:GetVerifiedAccessInstanceWebAcl",
        "ec2:GetVpcResourcesBlockingEncryptionEnforcement",
        "ec2:GetVpnConnectionDeviceTypes",
        "ec2:GetVpnTunnelReplacementStatus",
        "ec2:ListImagesInRecycleBin",
        "ec2:ListSnapshotsInRecycleBin",
        "ec2:ListVolumesInRecycleBin",
        "ec2:SearchLocalGatewayRoutes",
        "ec2:SearchTransitGatewayMulticastGroups",
        "ec2:SearchTransitGatewayRoutes",
        "ecr:DescribeRegistry",
        "ecr:DescribeRepositories",
        "ecr:ListImages",
        "ecs:Describe*",
        "ecs:List*",
        "eks:DescribeAccessEntry",
        "eks:DescribeAddon",
        "eks:DescribeAddonConfiguration",
        "eks:DescribeAddonVersions",
        "eks:DescribeCapability",
        "eks:DescribeCluster",
        "eks:DescribeClusterVersions",
        "eks:DescribeEksAnywhereSubscription",
        "eks:DescribeFargateProfile",
        "eks:DescribeIdentityProviderConfig",
        "eks:DescribeInsight",
        "eks:DescribeInsightsRefresh",
        "eks:DescribeNodegroup",
        "eks:DescribePodIdentityAssociation",
        "eks:DescribeUpdate",
        "eks:ListAccessEntries",
        "eks:ListAccessPolicies",
        "eks:ListAddons",
        "eks:ListAssociatedAccessPolicies",
        "eks:ListCapabilities",
        "eks:ListClusters",
        "eks:ListEksAnywhereSubscriptions",
        "eks:ListFargateProfiles",
        "eks:ListIdentityProviderConfigs",
        "eks:ListInsights",
        "eks:ListNodegroups",
        "eks:ListPodIdentityAssociations",
        "eks:ListTagsForResource",
        "eks:ListUpdates",
        "elasticache:Describe*",
        "elasticbeanstalk:DescribeApplicationVersions",
        "elasticbeanstalk:DescribeApplications",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticbeanstalk:ListAvailableSolutionStacks",
        "elasticfilesystem:DescribeFileSystems",
        "elasticloadbalancing:DescribeInstanceHealth",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeLoadBalancerAttributes",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticmapreduce:List*",
        "elastictranscoder:List*",
        "emr-containers:ListTagsForResource",
        "emr-containers:ListVirtualClusters",
        "emr-serverless:ListApplications",
        "es:DescribeElasticsearchDomain",
        "es:DescribeElasticsearchDomains",
        "es:ListDomainNames",
        "events:ListRuleNamesByTarget",
        "events:ListRules",
        "events:ListTargetsByRule",
        "firehose:DescribeDeliveryStream",
        "firehose:List*",
        "fsx:DescribeFileSystems",
        "gamelift:List*",
        "glacier:DescribeJob",
        "glacier:GetVaultAccessPolicy",
        "glacier:GetVaultNotifications",
        "glacier:List*",
        "glue:GetJobRuns",
        "glue:GetResourcePolicies",
        "glue:GetSchema",
        "glue:GetTable",
        "glue:GetTableVersion",
        "glue:GetTableVersions",
        "glue:GetTables",
        "glue:GetTags",
        "glue:ListJobs",
        "glue:ListSchemaVersions",
        "glue:ListSchemas",
        "glue:ListSessions",
        "greengrass:List*",
        "iam:GetAccountSummary",
        "iam:GetLoginProfile",
        "iam:List*",
        "importexport:ListJobs",
        "inspector:List*",
        "iot:List*",
        "kafka:ListClusters",
        "kendra:ListDataSources",
        "kendra:ListTagsForResource",
        "kinesis:ListStreams",
        "kinesisanalytics:ListApplications",
        "kinesisanalytics:ListTagsForResource",
        "kms:ListKeys",
        "kms:ListResourceTags",
        "lambda:GetPolicy",
        "lambda:GetProvisionedConcurrencyConfig",
        "lambda:GetResourcePolicy",
        "lambda:List*",
        "lex:GetBotAliases",
        "lex:GetBotChannelAssociations",
        "lex:GetBotVersions",
        "lex:GetBots",
        "lex:GetIntentVersions",
        "lex:GetIntents",
        "lex:GetSlotTypeVersions",
        "lex:GetSlotTypes",
        "lex:GetUtterancesView",
        "lightsail:GetBlueprints",
        "lightsail:GetBundles",
        "lightsail:GetInstancePortStates",
        "lightsail:GetInstanceSnapshots",
        "lightsail:GetInstances",
        "lightsail:GetKeyPair",
        "lightsail:GetRegions",
        "lightsail:GetStaticIps",
        "lightsail:IsVpcPeered",
        "logs:Describe*",
        "logs:GetTransformer",
        "logs:ListEntitiesForLogGroup",
        "logs:ListLogGroupsForEntity",
        "logs:ListLogGroupsForQuery",
        "logs:ListTagsForResource",
        "lookoutvision:ListModelPackagingJobs",
        "lookoutvision:ListModels",
        "lookoutvision:ListProjects",
        "m2:GetApplication",
        "m2:GetEnvironment",
        "m2:ListApplications",
        "m2:ListEnvironments",
        "m2:ListTagsForResource",
        "machinelearning:Describe*",
        "mediaconnect:ListEntitlements",
        "mediaconnect:ListFlows",
        "mediaconnect:ListOfferings",
        "mediaconnect:ListReservations",
        "mediaconnect:ListRouterInputs",
        "mediaconnect:ListRouterNetworkInterfaces",
        "mediaconnect:ListRouterOutputs",
        "mediastore:DescribeContainer",
        "mediastore:GetLifecyclePolicy",
        "mediastore:ListTagsForResource",
        "memorydb:DescribeAcls",
        "memorydb:DescribeUsers",
        "mobiletargeting:GetApplicationSettings",
        "mobiletargeting:GetCampaigns",
        "mobiletargeting:GetImportJobs",
        "mobiletargeting:GetSegments",
        "oam:ListAttachedLinks",
        "oam:ListLinks",
        "oam:ListSinks",
        "opsworks-cm:Describe*",
        "opsworks:Describe*",
        "organizations:List*",
        "outposts:GetOutpost",
        "outposts:GetOutpostInstanceTypes",
        "outposts:ListOutposts",
        "outposts:ListSites",
        "outposts:ListTagsForResource",
        "polly:Describe*",
        "polly:List*",
        "profile:ListDomains",
        "profile:ListIntegrations",
        "qapps:GetQApp",
        "qapps:ListQApps",
        "qapps:ListTagsForResource",
        "qbusiness:GetApplication",
        "qbusiness:GetDataSource",
        "qbusiness:GetIndex",
        "qbusiness:GetPlugin",
        "qbusiness:GetPolicy",
        "qbusiness:GetRetriever",
        "qbusiness:GetWebExperience",
        "ram:GetResourceShareAssociations",
        "rds:Describe*",
        "redshift-serverless:GetCustomDomainAssociation",
        "redshift-serverless:GetEndpointAccess",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetRecoveryPoint",
        "redshift-serverless:GetResourcePolicy",
        "redshift-serverless:ListSnapshots",
        "redshift-serverless:ListTagsForResource",
        "redshift-serverless:ListWorkgroups",
        "redshift:DescribeClusters",
        "redshift:DescribeEvents",
        "redshift:ViewQueriesInConsole",
        "resource-explorer-2:GetDefaultView",
        "resource-explorer-2:GetIndex",
        "resource-explorer-2:ListIndexes",
        "resource-explorer-2:ListSupportedResourceTypes",
        "resource-explorer-2:ListTagsForResource",
        "resource-explorer-2:ListViews",
        "rolesanywhere:ListCrls",
        "rolesanywhere:ListProfiles",
        "rolesanywhere:ListSubjects",
        "rolesanywhere:ListTagsForResource",
        "rolesanywhere:ListTrustAnchors",
        "route53:Get*",
        "route53:List*",
        "route53domains:List*",
        "route53profiles:GetProfile",
        "route53profiles:GetProfileAssociation",
        "route53profiles:GetProfileResourceAssociation",
        "route53profiles:ListProfileAssociations",
        "route53profiles:ListProfileResourceAssociations",
        "route53profiles:ListProfiles",
        "route53profiles:ListTagsForResource",
        "route53resolver:Get*",
        "route53resolver:List*",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListMultiRegionAccessPoints",
        "sagemaker:Describe*",
        "sagemaker:List*",
        "sdb:List*",
        "servicecatalog:List*",
        "ses:DescribeActiveReceiptRuleSet",
        "ses:List*",
        "ses:ListDedicatedIpPools",
        "shield:List*",
        "sns:GetDataProtectionPolicy",
        "sns:GetSubscriptionAttributes",
        "sns:List*",
        "sqs:GetQueueAttributes",
        "sqs:GetQueueUrl",
        "sqs:ListDeadLetterSourceQueues",
        "sqs:ListMessageMoveTasks",
        "sqs:ListQueueTags",
        "sqs:ListQueues",
        "ssm:ListAssociations",
        "ssm:ListDocuments",
        "states:ListActivities",
        "states:ListExecutions",
        "states:ListMapRuns",
        "states:ListStateMachineAliases",
        "states:ListStateMachineVersions",
        "states:ListStateMachines",
        "storagegateway:DescribeSMBSettings",
        "storagegateway:ListGateways",
        "storagegateway:ListLocalDisks",
        "storagegateway:ListVolumeRecoveryPoints",
        "storagegateway:ListVolumes",
        "swf:List*",
        "tiros:GetQueryAnswer",
        "tiros:GetQueryExplanation",
        "tiros:GetQueryExtensionAccounts",
        "trustedadvisor:Describe*",
        "uxc:GetAccountCustomizations",
        "uxc:ListServices",
        "waf-regional:List*",
        "waf:List*",
        "wafv2:List*",
        "wisdom:ListAssistants",
        "workdocs:DescribeAvailableDirectories",
        "workdocs:DescribeInstances",
        "workmail:Describe*",
        "workspaces:Describe*",
        "xray:GetEncryptionConfig",
        "xray:GetGroups",
        "xray:GetSamplingRules",
        "xray:GetSamplingStatisticSummaries",
        "xray:GetSamplingTargets",
        "xray:GetTraceSegmentDestination",
        "xray:ListResourcePolicies"
      ],
      "Resource": "*"
    },
    {
      "Sid": "APIGatewayAccess",
      "Effect": "Allow",
      "Action": [
        "apigateway:GET"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/apis",
        "arn:aws:apigateway:*::/apis/*/authorizers/*",
        "arn:aws:apigateway:*::/apis/*/authorizers",
        "arn:aws:apigateway:*::/apis/*/cors",
        "arn:aws:apigateway:*::/apis/*/deployments/*",
        "arn:aws:apigateway:*::/apis/*/deployments",
        "arn:aws:apigateway:*::/apis/*/exports/*",
        "arn:aws:apigateway:*::/apis/*/integrations/*",
        "arn:aws:apigateway:*::/apis/*/integrations",
        "arn:aws:apigateway:*::/apis/*/models/*",
        "arn:aws:apigateway:*::/apis/*/models",
        "arn:aws:apigateway:*::/apis/*/routes/*",
        "arn:aws:apigateway:*::/apis/*/routes",
        "arn:aws:apigateway:*::/apis/*/stages",
        "arn:aws:apigateway:*::/apis/*/stages/*",
        "arn:aws:apigateway:*::/clientcertificates",
        "arn:aws:apigateway:*::/clientcertificates/*",
        "arn:aws:apigateway:*::/domainnames",
        "arn:aws:apigateway:*::/domainnames/*/apimappings",
        "arn:aws:apigateway:*::/restapis",
        "arn:aws:apigateway:*::/restapis/*/authorizers/*",
        "arn:aws:apigateway:*::/restapis/*/authorizers",
        "arn:aws:apigateway:*::/restapis/*/deployments/*",
        "arn:aws:apigateway:*::/restapis/*/deployments",
        "arn:aws:apigateway:*::/restapis/*/documentation/parts/*",
        "arn:aws:apigateway:*::/restapis/*/documentation/parts",
        "arn:aws:apigateway:*::/restapis/*/documentation/versions/*",
        "arn:aws:apigateway:*::/restapis/*/documentation/versions",
        "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*",
        "arn:aws:apigateway:*::/restapis/*/gatewayresponses",
        "arn:aws:apigateway:*::/restapis/*/models/*",
        "arn:aws:apigateway:*::/restapis/*/models",
        "arn:aws:apigateway:*::/restapis/*/requestvalidators",
        "arn:aws:apigateway:*::/restapis/*/requestvalidators/*",
        "arn:aws:apigateway:*::/restapis/*/resources/*",
        "arn:aws:apigateway:*::/restapis/*/resources",
        "arn:aws:apigateway:*::/restapis/*/stages",
        "arn:aws:apigateway:*::/restapis/*/stages/*",
        "arn:aws:apigateway:*::/tags/*",
        "arn:aws:apigateway:*::/vpclinks"
      ]
    }
  ]
}

Version history

Current version v48, edited by AWS on 2026-10-30. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/job-function/ViewOnlyAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess

Terraform

resource "aws_iam_role_policy_attachment" "job_function_viewonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("job-function/ViewOnlyAccess"),
);

Sources

ViewOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-12; supports summary, practicalScope, assignmentGuidance, faqs)
AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports summary, practicalScope, useCases, bestPractices, securityConsiderations, assignmentGuidance, faqs)
Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)