WellArchitectedAgentResourceScanning

Summary

Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanningCopy ARN

Default version

v2

Created

2026-07-16

Last edited

2026-09-30

Services

access-analyzer, acm, acm-pca, aco-automation, aidevops, aiops, airflow, airflow-serverless, amplify, amplifyuibuilder, aoss, apigateway, app-integrations, appconfig, appflow, application-autoscaling, application-signals, applicationinsights, apprunner, appstream, appsync, apptest, aps, arc-region-switch, arc-zonal-shift, athena, auditmanager, autoscaling, aws-external-anthropic, b2bi, backup, backup-gateway, batch, bcm-data-exports, bcm-pricing-calculator, bedrock, bedrock-agentcore, bedrock-mantle, billing, billingconductor, braket, budgets, cases, ce, chatbot, chime, cleanrooms, cleanrooms-ml, cloudformation, cloudfront, cloudtrail, cloudwatch, codeartifact, codebuild, codecommit, codeconnections, codedeploy, codeguru-profiler, codeguru-reviewer, codepipeline, codestar-connections, codestar-notifications, cognito-identity, cognito-idp, comprehend, config, connect, connect-campaigns, controltower, cur, databrew, datapipeline, datasync, datazone, deadline, detective, devicefarm, devops-guru, directconnect, dms, docdb-elastic, ds, dsql, dynamodb, ec2, ecr, ecr-public, ecs, eks, elasticache, elasticbeanstalk, elasticfilesystem, elasticloadbalancing, elasticmapreduce, elemental-inference, emr-containers, emr-serverless, entityresolution, es, events, evs, finspace, firehose, fis, fms, forecast, frauddetector, fsx, gamelift, gameliftstreams, geo, globalaccelerator, glue, grafana, greengrass, groundstation, guardduty, healthlake, iam, identitystore, imagebuilder, inspector, inspector2, interconnect, internetmonitor, invoicing, iot, iotanalytics, iotdeviceadvisor, iotfleetwise, iotsitewise, iottwinmaker, iotwireless, ivs, ivschat, kafka, kafka-cluster, kafkaconnect, kendra, kendra-ranking, kinesis, kinesisanalytics, kinesisvideo, kms, lakeformation, lambda, launchwizard, lex, license-manager, lightsail, logs, lookoutequipment, lookoutvision, m2, macie2, managedblockchain, mediaconnect, medialive, mediapackage, mediapackage-vod, mediapackagev2, mediatailor, medical-imaging, memorydb, mobiletargeting, mpa, mq, neptune-graph, network-firewall, networkmanager, nimble, notifications, notifications-contacts, nova-act, oam, observabilityadmin, odb, omics, organizations, osis, panorama, payment-cryptography, pca-connector-ad, pca-connector-scep, pcs, personalize, pipes, profile, proton, qbusiness, qldb, quicksight, ram, rbin, rds, redshift, redshift-serverless, refactor-spaces, rekognition, resiliencehub, resource-explorer-2, resource-groups, robomaker, rolesanywhere, route53, route53-recovery-control-config, route53-recovery-readiness, route53globalresolver, route53profiles, route53resolver, rtbfabric, rum, s3, s3-outposts, s3express, s3files, s3tables, s3vectors, sagemaker, scheduler, schemas, secretsmanager, securityagent, securityhub, securitylake, servicecatalog, ses, shield, signer, simspaceweaver, sms-voice, sns, sqs, ssm, ssm-contacts, ssm-guiconnect, ssm-incidents, ssm-quicksetup, ssm-sap, sso, sso-directory, states, sts, supportapp, synthetics, tag, thinclient, timestream, timestream-influxdb, transfer, trustedadvisor, verifiedpermissions, voiceid, vpc-lattice, wafv2, wisdom, workspaces, workspaces-instances, workspaces-web, xray

Control-plane actions (5442)

By access level: 2432 List, 4 Permissions management, 2998 Read, 1 Tagging, 7 Write.

The full action list is in actions.json.

Data-plane actions (99)

By access level: 40 List, 58 Read, 1 Write.

The full action list is in actions.json.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: all-resources.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 13 write, tagging or permissions-management actions, short of full control of any service.
• 1 granted write or permissions-management action has no data-plane classification from AWS, so the data-plane rule cannot assess it.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same domain

• AgentRegistryFullAccess
• AgentRegistryReadOnlyAccess
• AIOpsAssistantIncidentReportPolicy
• AIOpsAssistantPolicy
• AIOpsConsoleAdminPolicy
• AIOpsOperatorAccess
• AIOpsReadOnlyAccess
• AmazonAugmentedAIFullAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudControlDiscoveryCompact",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:GetAnalyzer",
        "access-analyzer:List*",
        "acm-pca:Describe*",
        "acm-pca:Get*",
        "acm-pca:List*",
        "acm:DescribeCertificate",
        "aco-automation:GetAutomationRule",
        "aco-automation:ListAutomationRules",
        "aidevops:DescribePrivateConnection",
        "aidevops:Get*",
        "aidevops:List*",
        "aiops:Get*",
        "aiops:List*",
        "airflow-serverless:GetWorkflow",
        "airflow-serverless:List*",
        "airflow:GetEnvironment",
        "airflow:ListEnvironments",
        "amplify:Get*",
        "amplify:List*",
        "amplifyuibuilder:Get*",
        "amplifyuibuilder:List*",
        "apigateway:GetRoutingRule",
        "apigateway:ListRoutingRules",
        "app-integrations:Get*",
        "app-integrations:List*",
        "appconfig:Get*",
        "appconfig:List*",
        "appflow:Describe*",
        "appflow:List*",
        "application-autoscaling:Describe*",
        "application-signals:GetServiceLevelObjective",
        "application-signals:List*",
        "applicationinsights:Describe*",
        "applicationinsights:List*",
        "apprunner:Describe*",
        "apprunner:List*",
        "appstream:Describe*",
        "appstream:List*",
        "apptest:GetTestCase",
        "apptest:List*",
        "aps:Describe*",
        "aps:List*",
        "arc-region-switch:GetPlan",
        "arc-region-switch:List*",
        "arc-zonal-shift:Get*",
        "arc-zonal-shift:ListManagedResources",
        "athena:Get*",
        "athena:List*",
        "auditmanager:GetAssessment",
        "auditmanager:List*",
        "autoscaling:Describe*",
        "aws-external-anthropic:GetWorkspace",
        "aws-external-anthropic:List*",
        "b2bi:Get*",
        "b2bi:List*",
        "backup-gateway:GetHypervisor",
        "backup-gateway:List*",
        "backup:Describe*",
        "backup:Get*",
        "backup:List*",
        "batch:Describe*",
        "batch:List*",
        "bcm-data-exports:GetExport",
        "bcm-data-exports:List*",
        "bcm-pricing-calculator:GetBillScenario",
        "bcm-pricing-calculator:List*",
        "bedrock-agentcore:Get*",
        "bedrock-agentcore:List*",
        "bedrock-mantle:GetProject",
        "bedrock-mantle:List*",
        "bedrock:Get*",
        "bedrock:List*",
        "billing:GetBillingView",
        "billing:List*",
        "billingconductor:List*",
        "braket:ListTagsForResource",
        "braket:Search*",
        "budgets:Describe*",
        "budgets:ListTagsForResource",
        "ce:DescribeCostCategoryDefinition",
        "ce:Get*",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageWithResources",
        "ce:List*",
        "chatbot:Describe*",
        "chatbot:Get*",
        "chatbot:List*",
        "chime:Describe*",
        "chime:List*",
        "cleanrooms-ml:Get*",
        "cleanrooms-ml:List*",
        "cleanrooms:Get*",
        "cleanrooms:List*",
        "cloudformation:DescribeType",
        "cloudformation:GetResource",
        "cloudformation:ListResources",
        "cloudformation:ListTypes",
        "cloudfront:Describe*",
        "cloudfront:Get*",
        "cloudfront:List*",
        "cloudtrail:Describe*",
        "cloudtrail:Get*",
        "cloudtrail:List*",
        "cloudwatch:Describe*",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:Get*",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:GetMetricWidgetImage",
        "cloudwatch:List*",
        "cloudwatch:ListMetrics",
        "codeartifact:Describe*",
        "codeartifact:Get*",
        "codeartifact:List*",
        "codebuild:BatchGetFleets",
        "codebuild:ListFleets",
        "codecommit:Get*",
        "codeconnections:GetConnection",
        "codeconnections:List*",
        "codedeploy:Get*",
        "codedeploy:List*",
        "codeguru-profiler:DescribeProfilingGroup",
        "codeguru-profiler:Get*",
        "codeguru-profiler:List*",
        "codeguru-reviewer:DescribeRepositoryAssociation",
        "codeguru-reviewer:List*",
        "codepipeline:Get*",
        "codepipeline:List*",
        "codestar-connections:Get*",
        "codestar-connections:List*",
        "codestar-notifications:DescribeNotificationRule",
        "codestar-notifications:ListNotificationRules",
        "cognito-identity:DescribeIdentityPool",
        "cognito-identity:Get*",
        "cognito-identity:ListIdentityPools",
        "comprehend:Describe*",
        "comprehend:List*",
        "config:Describe*",
        "config:GetStoredQuery",
        "config:List*",
        "connect-campaigns:Describe*",
        "connect-campaigns:List*",
        "controltower:Get*",
        "controltower:List*",
        "cur:Describe*",
        "cur:ListTagsForResource",
        "databrew:Describe*",
        "databrew:List*",
        "datapipeline:DescribePipelines",
        "datapipeline:GetPipelineDefinition",
        "datapipeline:ListPipelines",
        "datasync:Describe*",
        "datasync:List*",
        "deadline:Get*",
        "deadline:List*",
        "detective:Describe*",
        "detective:GetMembers",
        "detective:List*",
        "devicefarm:Get*",
        "devicefarm:List*",
        "devops-guru:Describe*",
        "devops-guru:Get*",
        "devops-guru:List*",
        "directconnect:Describe*",
        "dms:Describe*",
        "dms:List*",
        "ds:Describe*",
        "ds:ListTagsForResource",
        "dsql:Get*",
        "dsql:List*",
        "ecr-public:Describe*",
        "ecr-public:Get*",
        "ecr-public:ListTagsForResource",
        "ecr:Describe*",
        "ecr:Get*",
        "ecr:List*",
        "ecs:Describe*",
        "ecs:List*",
        "eks:Describe*",
        "eks:List*",
        "elasticbeanstalk:Describe*",
        "elasticbeanstalk:List*",
        "elasticfilesystem:Describe*",
        "elasticloadbalancing:Describe*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:GetStudioSessionMapping",
        "elasticmapreduce:List*",
        "elemental-inference:GetFeed",
        "elemental-inference:List*",
        "emr-containers:Describe*",
        "emr-containers:List*",
        "emr-serverless:GetApplication",
        "emr-serverless:ListApplications",
        "entityresolution:Get*",
        "entityresolution:List*",
        "events:Describe*",
        "events:List*",
        "evidently:GetSegment",
        "evidently:List*",
        "evs:GetEnvironment",
        "evs:List*",
        "finspace:GetEnvironment",
        "finspace:ListEnvironments",
        "firehose:DescribeDeliveryStream",
        "firehose:List*",
        "fis:Get*",
        "fis:List*",
        "fms:Get*",
        "fms:List*",
        "forecast:Describe*",
        "forecast:List*",
        "fsx:Describe*",
        "gamelift:Describe*",
        "gamelift:List*",
        "gamelift:ValidateMatchmakingRuleSet",
        "gameliftstreams:Get*",
        "gameliftstreams:List*",
        "geo:Describe*",
        "geo:List*",
        "globalaccelerator:Describe*",
        "globalaccelerator:List*",
        "grafana:Describe*",
        "grafana:ListWorkspaces",
        "greengrass:DescribeComponent",
        "greengrass:GetDeployment",
        "greengrass:List*",
        "groundstation:Get*",
        "groundstation:List*",
        "guardduty:DescribePublishingDestination",
        "guardduty:Get*",
        "guardduty:List*",
        "healthlake:DescribeFHIRDatastore",
        "healthlake:List*",
        "iam:Get*",
        "iam:List*",
        "imagebuilder:Get*",
        "imagebuilder:List*",
        "inspector:Describe*",
        "inspector:List*",
        "inspector2:Get*",
        "inspector2:List*",
        "interconnect:GetConnection",
        "interconnect:List*",
        "internetmonitor:Get*",
        "internetmonitor:List*",
        "invoicing:GetInvoiceUnit",
        "invoicing:List*",
        "iot:Describe*",
        "iot:Get*",
        "iot:List*",
        "iotanalytics:Describe*",
        "iotanalytics:List*",
        "iotdeviceadvisor:GetSuiteDefinition",
        "iotdeviceadvisor:ListSuiteDefinitions",
        "iotevents:Describe*",
        "iotevents:List*",
        "iotfleetwise:Get*",
        "iotfleetwise:List*",
        "iotsitewise:Describe*",
        "iotsitewise:List*",
        "iottwinmaker:Get*",
        "iottwinmaker:List*",
        "iotwireless:Get*",
        "iotwireless:List*",
        "ivs:Get*",
        "ivs:List*",
        "ivschat:Get*",
        "ivschat:List*",
        "kafka-cluster:Describe*",
        "kafka:Describe*",
        "kafka:Get*",
        "kafka:List*",
        "kafkaconnect:Describe*",
        "kafkaconnect:List*",
        "kendra-ranking:DescribeRescoreExecutionPlan",
        "kendra-ranking:List*",
        "kendra:Describe*",
        "kendra:List*",
        "kinesis:Describe*",
        "kinesis:List*",
        "kinesisanalytics:DescribeApplication",
        "kinesisanalytics:List*",
        "kinesisvideo:Describe*",
        "kinesisvideo:List*",
        "lakeformation:Describe*",
        "lakeformation:GetLFTag",
        "lakeformation:List*",
        "lambda:GetFunctionConcurrency",
        "launchwizard:GetDeployment",
        "launchwizard:List*",
        "lex:Describe*",
        "lex:GetBotAlias",
        "lex:List*",
        "license-manager:Get*",
        "license-manager:List*",
        "logs:Describe*",
        "logs:Get*",
        "logs:List*",
        "lookoutequipment:DescribeInferenceScheduler",
        "lookoutequipment:ListInferenceSchedulers",
        "lookoutvision:DescribeProject",
        "lookoutvision:ListProjects",
        "m2:Get*",
        "m2:List*",
        "macie2:Get*",
        "macie2:List*",
        "managedblockchain:GetAccessor",
        "managedblockchain:ListAccessors",
        "mediaconnect:Describe*",
        "mediaconnect:Get*",
        "mediaconnect:List*",
        "medialive:Describe*",
        "medialive:Get*",
        "medialive:List*",
        "mediapackage-vod:Describe*",
        "mediapackage-vod:List*",
        "mediapackage:Describe*",
        "mediapackage:List*",
        "mediapackagev2:Get*",
        "mediapackagev2:List*",
        "mediatailor:Describe*",
        "mediatailor:GetPlaybackConfiguration",
        "mediatailor:List*",
        "medical-imaging:GetDatastore",
        "medical-imaging:List*",
        "mobiletargeting:Get*",
        "mobiletargeting:List*",
        "mpa:Get*",
        "mpa:List*",
        "mq:Describe*",
        "mq:List*",
        "network-firewall:Describe*",
        "network-firewall:List*",
        "networkmanager:Describe*",
        "networkmanager:Get*",
        "networkmanager:List*",
        "nimble:GetStudio",
        "nimble:ListStudios",
        "notifications-contacts:GetEmailContact",
        "notifications-contacts:List*",
        "notifications:Get*",
        "notifications:List*",
        "nova-act:GetWorkflowDefinition",
        "nova-act:ListWorkflowDefinitions",
        "oam:Get*",
        "oam:List*",
        "observabilityadmin:Get*",
        "observabilityadmin:List*",
        "odb:Get*",
        "odb:List*",
        "omics:Get*",
        "omics:List*",
        "organizations:Describe*",
        "organizations:List*",
        "osis:Get*",
        "osis:List*",
        "panorama:Describe*",
        "panorama:List*",
        "payment-cryptography:Get*",
        "payment-cryptography:List*",
        "pca-connector-ad:Get*",
        "pca-connector-ad:List*",
        "pca-connector-scep:Get*",
        "pca-connector-scep:List*",
        "pcs:Get*",
        "pcs:List*",
        "personalize:Describe*",
        "personalize:List*",
        "pipes:DescribePipe",
        "pipes:ListPipes",
        "profile:Get*",
        "profile:List*",
        "proton:Get*",
        "proton:List*",
        "qbusiness:Get*",
        "qbusiness:List*",
        "quicksight:Describe*",
        "quicksight:List*",
        "ram:Get*",
        "ram:List*",
        "rbin:GetRule",
        "rbin:List*",
        "refactor-spaces:Get*",
        "refactor-spaces:List*",
        "rekognition:Describe*",
        "rekognition:List*",
        "resiliencehub:Describe*",
        "resiliencehub:Get*",
        "resiliencehub:List*",
        "resource-explorer-2:Get*",
        "resource-explorer-2:List*",
        "resource-groups:Get*",
        "resource-groups:List*",
        "resource-groups:SearchResources",
        "robomaker:Describe*",
        "robomaker:List*",
        "rolesanywhere:Get*",
        "rolesanywhere:List*",
        "route53-recovery-control-config:Describe*",
        "route53-recovery-control-config:List*",
        "route53-recovery-readiness:Get*",
        "route53-recovery-readiness:List*",
        "route53:Get*",
        "route53:List*",
        "route53profiles:Get*",
        "route53profiles:List*",
        "route53resolver:Get*",
        "route53resolver:List*",
        "rtbfabric:Get*",
        "rtbfabric:List*",
        "rum:BatchGetRumMetricDefinitions",
        "rum:Get*",
        "rum:List*",
        "sagemaker:Describe*",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:List*",
        "sagemaker:ListMonitoringSchedules",
        "scheduler:Get*",
        "scheduler:List*",
        "schemas:Describe*",
        "schemas:List*",
        "securitylake:Get*",
        "securitylake:List*",
        "servicecatalog:Describe*",
        "servicecatalog:Get*",
        "servicecatalog:List*",
        "ses:Describe*",
        "ses:Get*",
        "ses:List*",
        "shield:Describe*",
        "shield:List*",
        "signer:Get*",
        "signer:List*",
        "simspaceweaver:DescribeSimulation",
        "simspaceweaver:ListSimulations",
        "sms-voice:Describe*",
        "sms-voice:Get*",
        "sms-voice:List*",
        "sns:Get*",
        "sns:List*",
        "sqs:GetQueueAttributes",
        "sqs:List*",
        "ssm-contacts:Get*",
        "ssm-contacts:List*",
        "ssm-guiconnect:Get*",
        "ssm-incidents:Get*",
        "ssm-incidents:List*",
        "ssm-quicksetup:GetConfigurationManager",
        "ssm-quicksetup:ListConfigurationManagers",
        "ssm-sap:GetApplication",
        "ssm-sap:List*",
        "sso:Describe*",
        "sso:Get*",
        "sso:List*",
        "states:Describe*",
        "states:List*",
        "supportapp:Get*",
        "supportapp:List*",
        "synthetics:Describe*",
        "synthetics:Get*",
        "synthetics:List*",
        "tag:GetResources",
        "thinclient:GetEnvironment",
        "thinclient:List*",
        "transfer:Describe*",
        "transfer:List*",
        "trustedadvisor:GetRecommendation",
        "trustedadvisor:ListChecks",
        "trustedadvisor:ListRecommendationResources",
        "trustedadvisor:ListRecommendations",
        "trustedadvisor:ListRecommendationsForResource",
        "verifiedpermissions:Get*",
        "verifiedpermissions:List*",
        "voiceid:DescribeDomain",
        "voiceid:List*",
        "vpc-lattice:Get*",
        "vpc-lattice:List*",
        "wafv2:Get*",
        "wafv2:List*",
        "wisdom:Get*",
        "wisdom:List*",
        "workspaces-instances:Get*",
        "workspaces-instances:List*",
        "workspaces-web:Get*",
        "workspaces-web:List*",
        "workspaces:Describe*",
        "xray:Get*",
        "xray:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CloudControlDiscoveryCompactExact",
      "Effect": "Allow",
      "Action": [
        "aoss:BatchGetCollection",
        "aoss:BatchGetCollectionGroup",
        "aoss:BatchGetLifecyclePolicy",
        "aoss:BatchGetVpcEndpoint",
        "aoss:GetAccessPolicy",
        "aoss:GetSecurityConfig",
        "aoss:GetSecurityPolicy",
        "aoss:ListAccessPolicies",
        "aoss:ListCollectionGroups",
        "aoss:ListCollections",
        "aoss:ListLifecyclePolicies",
        "aoss:ListSecurityConfigs",
        "aoss:ListSecurityPolicies",
        "aoss:ListTagsForResource",
        "aoss:ListVpcEndpoints",
        "appsync:GetApi",
        "appsync:GetChannelNamespace",
        "appsync:GetDataSource",
        "appsync:GetDomainName",
        "appsync:GetGraphqlApi",
        "appsync:GetSourceApiAssociation",
        "appsync:ListApis",
        "appsync:ListChannelNamespaces",
        "appsync:ListDataSources",
        "appsync:ListDomainNames",
        "appsync:ListFunctions",
        "appsync:ListGraphqlApis",
        "appsync:ListResolvers",
        "appsync:ListSourceApiAssociations",
        "appsync:ListTagsForResource",
        "cases:BatchGetCaseRule",
        "cases:BatchGetField",
        "cases:GetDomain",
        "cases:GetLayout",
        "cases:GetTemplate",
        "cases:ListCaseRules",
        "cases:ListDomains",
        "cases:ListFields",
        "cases:ListLayouts",
        "cases:ListTemplates",
        "cloudformation:BatchDescribeTypeConfigurations",
        "cloudformation:DescribePublisher",
        "cloudformation:DescribeStackInstance",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackSet",
        "cloudformation:DescribeType",
        "cloudformation:GetStackPolicy",
        "cloudformation:GetTemplate",
        "cloudformation:ListStackInstances",
        "cloudformation:ListStackResources",
        "cloudformation:ListStacks",
        "cloudformation:ListStackSets",
        "cloudformation:ListTypes",
        "cloudformation:ListTypeVersions",
        "cognito-idp:DescribeIdentityProvider",
        "cognito-idp:DescribeResourceServer",
        "cognito-idp:DescribeTerms",
        "cognito-idp:DescribeUserPool",
        "cognito-idp:DescribeUserPoolClient",
        "cognito-idp:GetGroup",
        "cognito-idp:GetUserPoolMfaConfig",
        "cognito-idp:ListGroups",
        "cognito-idp:ListIdentityProviders",
        "cognito-idp:ListResourceServers",
        "cognito-idp:ListTerms",
        "cognito-idp:ListUserPoolClients",
        "cognito-idp:ListUserPools",
        "connect:DescribeAgentStatus",
        "connect:DescribeContactFlow",
        "connect:DescribeContactFlowModule",
        "connect:DescribeContactFlowModuleAlias",
        "connect:DescribeDataTable",
        "connect:DescribeEvaluationForm",
        "connect:DescribeHoursOfOperation",
        "connect:DescribeInstance",
        "connect:DescribeInstanceStorageConfig",
        "connect:DescribeNotification",
        "connect:DescribePhoneNumber",
        "connect:DescribePredefinedAttribute",
        "connect:DescribePrompt",
        "connect:DescribeQueue",
        "connect:DescribeQuickConnect",
        "connect:DescribeRoutingProfile",
        "connect:DescribeRule",
        "connect:DescribeSecurityProfile",
        "connect:DescribeTrafficDistributionGroup",
        "connect:DescribeUserHierarchyGroup",
        "connect:DescribeView",
        "connect:DescribeWorkspace",
        "connect:GetTaskTemplate",
        "connect:ListAgentStatuses",
        "connect:ListApprovedOrigins",
        "connect:ListBots",
        "connect:ListContactFlowModuleAliases",
        "connect:ListContactFlowModules",
        "connect:ListContactFlowModuleVersions",
        "connect:ListContactFlows",
        "connect:ListContactFlowVersions",
        "connect:ListDataTableAttributes",
        "connect:ListDataTables",
        "connect:ListEvaluationForms",
        "connect:ListEvaluationFormVersions",
        "connect:ListHoursOfOperationOverrides",
        "connect:ListHoursOfOperations",
        "connect:ListInstanceAttributes",
        "connect:ListInstances",
        "connect:ListInstanceStorageConfigs",
        "connect:ListIntegrationAssociations",
        "connect:ListLambdaFunctions",
        "connect:ListNotifications",
        "connect:ListPredefinedAttributes",
        "connect:ListPrompts",
        "connect:ListQueueEmailAddresses",
        "connect:ListQueueQuickConnects",
        "connect:ListQueues",
        "connect:ListQuickConnects",
        "connect:ListRoutingProfileManualAssignmentQueues",
        "connect:ListRoutingProfileQueues",
        "connect:ListRoutingProfiles",
        "connect:ListRules",
        "connect:ListSecurityKeys",
        "connect:ListSecurityProfileApplications",
        "connect:ListSecurityProfileFlowModules",
        "connect:ListSecurityProfilePermissions",
        "connect:ListSecurityProfiles",
        "connect:ListTagsForResource",
        "connect:ListTaskTemplates",
        "connect:ListTrafficDistributionGroups",
        "connect:ListUserHierarchyGroups",
        "connect:ListUserProficiencies",
        "connect:ListUsers",
        "connect:ListViews",
        "connect:ListViewVersions",
        "connect:ListWorkspaceMedia",
        "connect:ListWorkspacePages",
        "connect:ListWorkspaces",
        "connect:SearchWorkspaceAssociations",
        "datazone:GetDataSource",
        "datazone:GetDomain",
        "datazone:GetDomainUnit",
        "datazone:GetEnvironment",
        "datazone:GetEnvironmentAction",
        "datazone:GetEnvironmentBlueprintConfiguration",
        "datazone:GetEnvironmentProfile",
        "datazone:GetGroupProfile",
        "datazone:GetProject",
        "datazone:GetProjectProfile",
        "datazone:GetSubscriptionTarget",
        "datazone:GetUserProfile",
        "datazone:ListConnections",
        "datazone:ListDataSources",
        "datazone:ListDomains",
        "datazone:ListDomainUnitsForParent",
        "datazone:ListEntityOwners",
        "datazone:ListEnvironmentActions",
        "datazone:ListEnvironmentBlueprintConfigurations",
        "datazone:ListEnvironmentProfiles",
        "datazone:ListEnvironments",
        "datazone:ListPolicyGrants",
        "datazone:ListProjectMemberships",
        "datazone:ListProjectProfiles",
        "datazone:ListProjects",
        "datazone:ListSubscriptionTargets",
        "datazone:SearchGroupProfiles",
        "datazone:SearchUserProfiles",
        "docdb-elastic:GetCluster",
        "docdb-elastic:ListClusters",
        "docdb-elastic:ListTagsForResource",
        "dynamodb:DescribeContinuousBackups",
        "dynamodb:DescribeContributorInsights",
        "dynamodb:DescribeKinesisStreamingDestination",
        "dynamodb:DescribeTable",
        "dynamodb:DescribeTimeToLive",
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListTables",
        "dynamodb:ListTagsOfResource",
        "ec2:DescribeAccountAttributes",
        "ec2:DescribeAddresses",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeAwsNetworkPerformanceMetricSubscriptions",
        "ec2:DescribeCapacityManagerDataExports",
        "ec2:DescribeCapacityReservationFleets",
        "ec2:DescribeCapacityReservations",
        "ec2:DescribeCarrierGateways",
        "ec2:DescribeClientVpnEndpoints",
        "ec2:DescribeCustomerGateways",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeEgressOnlyInternetGateways",
        "ec2:DescribeFleets",
        "ec2:DescribeFlowLogs",
        "ec2:DescribeHosts",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstanceConnectEndpoints",
        "ec2:DescribeInstanceCreditSpecifications",
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceSqlHaStates",
        "ec2:DescribeInternetGateways",
        "ec2:DescribeIpamPools",
        "ec2:DescribeIpamPrefixListResolvers",
        "ec2:DescribeIpamPrefixListResolverTargets",
        "ec2:DescribeIpamResourceDiscoveries",
        "ec2:DescribeIpamResourceDiscoveryAssociations",
        "ec2:DescribeIpams",
        "ec2:DescribeIpamScopes",
        "ec2:DescribeKeyPairs",
        "ec2:DescribeLaunchTemplates",
        "ec2:DescribeLocalGatewayRouteTables",
        "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
        "ec2:DescribeLocalGatewayRouteTableVpcAssociations",
        "ec2:DescribeLocalGatewayVirtualInterfaceGroups",
        "ec2:DescribeLocalGatewayVirtualInterfaces",
        "ec2:DescribeManagedPrefixLists",
        "ec2:DescribeNatGateways",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeNetworkInsightsAccessScopeAnalyses",
        "ec2:DescribeNetworkInsightsAccessScopes",
        "ec2:DescribeNetworkInsightsPaths",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribePlacementGroups",
        "ec2:DescribeRouteServerEndpoints",
        "ec2:DescribeRouteServerPeers",
        "ec2:DescribeRouteServers",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSecurityGroupVpcAssociations",
        "ec2:DescribeSpotFleetRequests",
        "ec2:DescribeSubnets",
        "ec2:DescribeTags",
        "ec2:DescribeTrafficMirrorFilterRules",
        "ec2:DescribeTrafficMirrorFilters",
        "ec2:DescribeTrafficMirrorSessions",
        "ec2:DescribeTrafficMirrorTargets",
        "ec2:DescribeTransitGatewayConnectPeers",
        "ec2:DescribeTransitGatewayConnects",
        "ec2:DescribeTransitGatewayMeteringPolicies",
        "ec2:DescribeTransitGatewayMulticastDomains",
        "ec2:DescribeTransitGatewayPeeringAttachments",
        "ec2:DescribeTransitGatewayRouteTables",
        "ec2:DescribeTransitGateways",
        "ec2:DescribeTransitGatewayVpcAttachments",
        "ec2:DescribeVerifiedAccessEndpoints",
        "ec2:DescribeVerifiedAccessGroups",
        "ec2:DescribeVerifiedAccessInstanceLoggingConfigurations",
        "ec2:DescribeVerifiedAccessInstances",
        "ec2:DescribeVerifiedAccessTrustProviders",
        "ec2:DescribeVolumeAttribute",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcAttribute",
        "ec2:DescribeVpcBlockPublicAccessExclusions",
        "ec2:DescribeVpcEncryptionControls",
        "ec2:DescribeVpcEndpointAssociations",
        "ec2:DescribeVpcEndpointConnectionNotifications",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcEndpointServiceConfigurations",
        "ec2:DescribeVpcEndpointServicePermissions",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeVpcs",
        "ec2:DescribeVpnConcentrators",
        "ec2:DescribeVpnConnections",
        "ec2:DescribeVpnGateways",
        "ec2:GetAssociatedEnclaveCertificateIamRoles",
        "ec2:GetIpamPoolAllocations",
        "ec2:GetIpamPoolCidrs",
        "ec2:GetIpamPrefixListResolverRules",
        "ec2:GetManagedPrefixListEntries",
        "ec2:GetNetworkInsightsAccessScopeContent",
        "ec2:GetRouteServerAssociations",
        "ec2:GetRouteServerPropagations",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ec2:GetTransitGatewayMeteringPolicyEntries",
        "ec2:GetTransitGatewayMulticastDomainAssociations",
        "ec2:GetTransitGatewayRouteTableAssociations",
        "ec2:GetTransitGatewayRouteTablePropagations",
        "ec2:GetVerifiedAccessEndpointPolicy",
        "ec2:GetVerifiedAccessGroupPolicy",
        "ec2:SearchLocalGatewayRoutes",
        "ec2:SearchTransitGatewayMulticastGroups",
        "ec2:SearchTransitGatewayRoutes",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeCacheParameterGroups",
        "elasticache:DescribeCacheParameters",
        "elasticache:DescribeCacheSubnetGroups",
        "elasticache:DescribeGlobalReplicationGroups",
        "elasticache:DescribeReplicationGroups",
        "elasticache:DescribeServerlessCaches",
        "elasticache:DescribeUserGroups",
        "elasticache:DescribeUsers",
        "elasticache:ListTagsForResource",
        "es:GetApplication",
        "es:ListApplications",
        "es:ListTags",
        "frauddetector:BatchGetVariable",
        "frauddetector:DescribeDetector",
        "frauddetector:GetDetectors",
        "frauddetector:GetDetectorVersion",
        "frauddetector:GetEntityTypes",
        "frauddetector:GetEventTypes",
        "frauddetector:GetExternalModels",
        "frauddetector:GetLabels",
        "frauddetector:GetListsMetadata",
        "frauddetector:GetModelVersion",
        "frauddetector:GetOutcomes",
        "frauddetector:GetRules",
        "frauddetector:GetVariables",
        "frauddetector:ListTagsForResource",
        "glue:DescribeIntegrations",
        "glue:GetCatalog",
        "glue:GetCatalogs",
        "glue:GetCrawler",
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetIntegrationResourceProperty",
        "glue:GetJob",
        "glue:GetRegistry",
        "glue:GetSchema",
        "glue:GetSchemaVersion",
        "glue:GetTags",
        "glue:GetTrigger",
        "glue:GetUsageProfile",
        "glue:ListCrawlers",
        "glue:ListIntegrationResourceProperties",
        "glue:ListJobs",
        "glue:ListRegistries",
        "glue:ListSchemas",
        "glue:ListSchemaVersions",
        "glue:ListTriggers",
        "glue:ListUsageProfiles",
        "identitystore:DescribeGroup",
        "identitystore:ListGroupMemberships",
        "identitystore:ListGroupMembershipsForMember",
        "identitystore:ListGroups",
        "kms:DescribeCustomKeyStores",
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:GetKeyRotationStatus",
        "kms:GetParametersForImport",
        "kms:GetPublicKey",
        "kms:ListAliases",
        "kms:ListGrants",
        "kms:ListKeyPolicies",
        "kms:ListKeyRotations",
        "kms:ListKeys",
        "kms:ListResourceTags",
        "kms:ListRetirableGrants",
        "lambda:GetAlias",
        "lambda:GetCapacityProvider",
        "lambda:GetCodeSigningConfig",
        "lambda:GetEventSourceMapping",
        "lambda:GetFunction",
        "lambda:GetFunctionCodeSigningConfig",
        "lambda:GetFunctionConfiguration",
        "lambda:GetFunctionEventInvokeConfig",
        "lambda:GetFunctionRecursionConfig",
        "lambda:GetFunctionScalingConfig",
        "lambda:GetFunctionUrlConfig",
        "lambda:GetLayerVersionPolicy",
        "lambda:GetPolicy",
        "lambda:GetProvisionedConcurrencyConfig",
        "lambda:GetRuntimeManagementConfig",
        "lambda:ListAliases",
        "lambda:ListCapacityProviders",
        "lambda:ListCodeSigningConfigs",
        "lambda:ListEventSourceMappings",
        "lambda:ListFunctionEventInvokeConfigs",
        "lambda:ListFunctions",
        "lambda:ListFunctionUrlConfigs",
        "lambda:ListLayerVersions",
        "lambda:ListTags",
        "lambda:ListVersionsByFunction",
        "lightsail:GetAlarms",
        "lightsail:GetBuckets",
        "lightsail:GetCertificates",
        "lightsail:GetContainerServices",
        "lightsail:GetDisk",
        "lightsail:GetDisks",
        "lightsail:GetDiskSnapshot",
        "lightsail:GetDiskSnapshots",
        "lightsail:GetDistributions",
        "lightsail:GetDomain",
        "lightsail:GetDomains",
        "lightsail:GetInstance",
        "lightsail:GetInstances",
        "lightsail:GetInstanceSnapshot",
        "lightsail:GetInstanceSnapshots",
        "lightsail:GetLoadBalancer",
        "lightsail:GetLoadBalancers",
        "lightsail:GetLoadBalancerTlsCertificates",
        "lightsail:GetRelationalDatabase",
        "lightsail:GetRelationalDatabases",
        "lightsail:GetRelationalDatabaseSnapshot",
        "lightsail:GetRelationalDatabaseSnapshots",
        "lightsail:GetStaticIp",
        "lightsail:GetStaticIps",
        "memorydb:DescribeACLs",
        "memorydb:DescribeClusters",
        "memorydb:DescribeMultiRegionClusters",
        "memorydb:DescribeParameterGroups",
        "memorydb:DescribeSubnetGroups",
        "memorydb:DescribeUsers",
        "memorydb:ListTags",
        "neptune-graph:GetGraph",
        "neptune-graph:GetGraphSnapshot",
        "neptune-graph:GetPrivateGraphEndpoint",
        "neptune-graph:ListGraphs",
        "neptune-graph:ListGraphSnapshots",
        "neptune-graph:ListPrivateGraphEndpoints",
        "neptune-graph:ListTagsForResource",
        "qldb:DescribeJournalKinesisStream",
        "qldb:ListJournalKinesisStreamsForLedger",
        "qldb:ListTagsForResource",
        "rds:DescribeDBClusterParameterGroups",
        "rds:DescribeDBClusterParameters",
        "rds:DescribeDBClusters",
        "rds:DescribeDBEngineVersions",
        "rds:DescribeDBInstances",
        "rds:DescribeDBParameterGroups",
        "rds:DescribeDBParameters",
        "rds:DescribeDBProxies",
        "rds:DescribeDBProxyEndpoints",
        "rds:DescribeDBProxyTargetGroups",
        "rds:DescribeDBProxyTargets",
        "rds:DescribeDBShardGroups",
        "rds:DescribeDBSubnetGroups",
        "rds:DescribeEngineDefaultParameters",
        "rds:DescribeEventSubscriptions",
        "rds:DescribeGlobalClusters",
        "rds:DescribeIntegrations",
        "rds:DescribeOptionGroups",
        "rds:ListTagsForResource",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetSnapshot",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListSnapshotCopyConfigurations",
        "redshift-serverless:ListSnapshots",
        "redshift-serverless:ListTagsForResource",
        "redshift-serverless:ListWorkgroups",
        "redshift:DescribeClusterDbRevisions",
        "redshift:DescribeClusterParameterGroups",
        "redshift:DescribeClusterParameters",
        "redshift:DescribeClusters",
        "redshift:DescribeClusterSubnetGroups",
        "redshift:DescribeEndpointAccess",
        "redshift:DescribeEndpointAuthorization",
        "redshift:DescribeEventSubscriptions",
        "redshift:DescribeIntegrations",
        "redshift:DescribeLoggingStatus",
        "redshift:DescribeScheduledActions",
        "redshift:DescribeTags",
        "redshift:GetResourcePolicy",
        "route53globalresolver:GetAccessSource",
        "route53globalresolver:GetDNSView",
        "route53globalresolver:GetFirewallDomainList",
        "route53globalresolver:GetFirewallRule",
        "route53globalresolver:GetGlobalResolver",
        "route53globalresolver:GetHostedZoneAssociation",
        "route53globalresolver:ListAccessSources",
        "route53globalresolver:ListAccessTokens",
        "route53globalresolver:ListDNSViews",
        "route53globalresolver:ListFirewallDomainLists",
        "route53globalresolver:ListFirewallRules",
        "route53globalresolver:ListGlobalResolvers",
        "route53globalresolver:ListHostedZoneAssociations",
        "route53globalresolver:ListTagsForResource",
        "s3-outposts:GetAccessPoint",
        "s3-outposts:GetAccessPointPolicy",
        "s3-outposts:GetBucket",
        "s3-outposts:GetBucketTagging",
        "s3-outposts:GetLifecycleConfiguration",
        "s3-outposts:ListAccessPoints",
        "s3-outposts:ListEndpoints",
        "s3-outposts:ListRegionalBuckets",
        "s3:GetAccelerateConfiguration",
        "s3:GetAccessGrant",
        "s3:GetAccessGrantsInstance",
        "s3:GetAccessGrantsLocation",
        "s3:GetAccessPoint",
        "s3:GetAccessPointConfigurationForObjectLambda",
        "s3:GetAccessPointForObjectLambda",
        "s3:GetAccessPointPolicy",
        "s3:GetAccessPointPolicyStatusForObjectLambda",
        "s3:GetAnalyticsConfiguration",
        "s3:GetBucketAbac",
        "s3:GetBucketAcl",
        "s3:GetBucketCORS",
        "s3:GetBucketLocation",
        "s3:GetBucketLogging",
        "s3:GetBucketMetadataTableConfiguration",
        "s3:GetBucketNotification",
        "s3:GetBucketObjectLockConfiguration",
        "s3:GetBucketOwnershipControls",
        "s3:GetBucketPolicy",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketTagging",
        "s3:GetBucketVersioning",
        "s3:GetBucketWebsite",
        "s3:GetEncryptionConfiguration",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetMetricsConfiguration",
        "s3:GetMultiRegionAccessPoint",
        "s3:GetMultiRegionAccessPointPolicy",
        "s3:GetMultiRegionAccessPointPolicyStatus",
        "s3:GetObjectAcl",
        "s3:GetReplicationConfiguration",
        "s3:GetStorageLensConfiguration",
        "s3:GetStorageLensConfigurationTagging",
        "s3:GetStorageLensGroup",
        "s3:ListAccessGrants",
        "s3:ListAccessGrantsInstances",
        "s3:ListAccessGrantsLocations",
        "s3:ListAccessPoints",
        "s3:ListAccessPointsForObjectLambda",
        "s3:ListAllMyBuckets",
        "s3:ListMultiRegionAccessPoints",
        "s3:ListStorageLensConfigurations",
        "s3:ListStorageLensGroups",
        "s3:ListTagsForResource",
        "s3express:GetAccessPoint",
        "s3express:GetAccessPointPolicy",
        "s3express:GetAccessPointScope",
        "s3express:GetBucketPolicy",
        "s3express:GetEncryptionConfiguration",
        "s3express:GetInventoryConfiguration",
        "s3express:GetLifecycleConfiguration",
        "s3express:GetMetricsConfiguration",
        "s3express:ListAccessPointsForDirectoryBuckets",
        "s3express:ListAllMyDirectoryBuckets",
        "s3express:ListTagsForResource",
        "s3files:GetAccessPoint",
        "s3files:GetFileSystem",
        "s3files:GetFileSystemPolicy",
        "s3files:GetMountTarget",
        "s3files:GetSynchronizationConfiguration",
        "s3files:ListAccessPoints",
        "s3files:ListFileSystems",
        "s3files:ListMountTargets",
        "s3files:ListTagsForResource",
        "s3tables:GetNamespace",
        "s3tables:GetTable",
        "s3tables:GetTableBucket",
        "s3tables:GetTableBucketEncryption",
        "s3tables:GetTableBucketMaintenanceConfiguration",
        "s3tables:GetTableBucketMetricsConfiguration",
        "s3tables:GetTableBucketPolicy",
        "s3tables:GetTableBucketReplication",
        "s3tables:GetTableBucketStorageClass",
        "s3tables:GetTableMaintenanceConfiguration",
        "s3tables:GetTablePolicy",
        "s3tables:GetTableStorageClass",
        "s3tables:ListNamespaces",
        "s3tables:ListTableBuckets",
        "s3tables:ListTables",
        "s3tables:ListTagsForResource",
        "s3vectors:GetIndex",
        "s3vectors:GetVectorBucket",
        "s3vectors:GetVectorBucketPolicy",
        "s3vectors:ListIndexes",
        "s3vectors:ListTagsForResource",
        "s3vectors:ListVectorBuckets",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:ListSecrets",
        "securityagent:BatchGetAgentSpaces",
        "securityagent:BatchGetPentests",
        "securityagent:BatchGetTargetDomains",
        "securityagent:GetApplication",
        "securityagent:ListAgentSpaces",
        "securityagent:ListApplications",
        "securityagent:ListIntegratedResources",
        "securityagent:ListPentests",
        "securityagent:ListTagsForResource",
        "securityagent:ListTargetDomains",
        "securityhub:BatchGetAutomationRules",
        "securityhub:BatchGetSecurityControls",
        "securityhub:DescribeHub",
        "securityhub:DescribeOrganizationConfiguration",
        "securityhub:DescribeSecurityHubV2",
        "securityhub:DescribeStandardsControls",
        "securityhub:GetAggregatorV2",
        "securityhub:GetAutomationRuleV2",
        "securityhub:GetConfigurationPolicy",
        "securityhub:GetConfigurationPolicyAssociation",
        "securityhub:GetConnectorV2",
        "securityhub:GetEnabledStandards",
        "securityhub:GetFindingAggregator",
        "securityhub:GetInsights",
        "securityhub:ListAggregatorsV2",
        "securityhub:ListAutomationRules",
        "securityhub:ListAutomationRulesV2",
        "securityhub:ListConfigurationPolicies",
        "securityhub:ListConfigurationPolicyAssociations",
        "securityhub:ListConnectorsV2",
        "securityhub:ListEnabledProductsForImport",
        "securityhub:ListFindingAggregators",
        "securityhub:ListOrganizationAdminAccounts",
        "securityhub:ListSecurityControlDefinitions",
        "securityhub:ListTagsForResource",
        "ssm:DescribeAssociation",
        "ssm:DescribeDocument",
        "ssm:DescribeMaintenanceWindows",
        "ssm:DescribeMaintenanceWindowTargets",
        "ssm:DescribeMaintenanceWindowTasks",
        "ssm:DescribeParameters",
        "ssm:DescribePatchBaselines",
        "ssm:GetDefaultPatchBaseline",
        "ssm:GetDocument",
        "ssm:GetMaintenanceWindow",
        "ssm:GetMaintenanceWindowTask",
        "ssm:GetPatchBaseline",
        "ssm:GetResourcePolicies",
        "ssm:ListAssociations",
        "ssm:ListDocuments",
        "ssm:ListResourceDataSync",
        "ssm:ListTagsForResource",
        "sso-directory:DescribeGroup",
        "sso-directory:SearchGroups",
        "sts:GetCallerIdentity",
        "timestream-influxdb:GetDbCluster",
        "timestream-influxdb:GetDbInstance",
        "timestream-influxdb:ListDbClusters",
        "timestream-influxdb:ListDbInstances",
        "timestream-influxdb:ListTagsForResource",
        "timestream:DescribeDatabase",
        "timestream:DescribeEndpoints",
        "timestream:DescribeScheduledQuery",
        "timestream:DescribeTable",
        "timestream:ListDatabases",
        "timestream:ListScheduledQueries",
        "timestream:ListTables",
        "timestream:ListTagsForResource"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v2, edited by AWS on 2026-09-30. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning

resource "aws_iam_role_policy_attachment" "wellarchitectedagentresourcescanning" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/WellArchitectedAgentResourceScanning"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("WellArchitectedAgentResourceScanning"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for WellArchitectedAgentResourceScanning
• Report a data issue