CloudFormation
Prefix cloudformation, 104 actions · Domain Management & Governance
55 AWS managed policies. 6 have reviewed guidance; the rest have authoritative permission data pending editorial review. 17 are service-linked role policies, shown with permission data only.
User access (16)
- AdministratorAccess-AWSElasticBeanstalkAdmin
- AmazonLaunchWizard_FullaccessAdmin
- AWSAppMeshFullAccessAdmin
- AWSAppMeshReadOnlyReader
- AWSCloudFormationFullAccessAdmin
- AWSCloudFormationReadOnlyAccessReader
- AWSCodeStarFullAccessReader
- AWSDeepRacerCloudFormationAccessPolicyAdmin
- AWSElasticBeanstalkManagedUpdatesCustomerRolePolicyAdmin
- AWSIncidentManagerIncidentAccessServiceRolePolicyReader
- AWSMarketplaceFullAccessAdmin
- AWSServiceCatalogAdminFullAccessAdmin
- AWSServiceCatalogAdminReadOnlyAccessReader
- AWSServiceCatalogEndUserReadOnlyAccessReader
- ResourceGroupsandTagEditorReadOnlyAccessReader
- SecretsManagerReadWriteAdmin
Operator and limited (15)
- AIDevOpsOrganizationsAccessPolicyOperator
- AmazonDataZoneRedshiftGlueProvisioningPolicyOperator
- AWSForWordPressPluginPolicyOperator
- AWSQuickSetupDeploymentRolePolicyOperator
- AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
- AWSQuickSetupJITNADeploymentRolePolicyOperator
- AWSQuickSetupSSMDeploymentRolePolicyOperator
- AWSServiceCatalogAppRegistryFullAccessOperator
- AWSServiceCatalogEndUserFullAccessOperator
- AWSThinkboxAWSPortalAdminPolicyOperator
- AWSThinkboxDeadlineResourceTrackerAdminPolicyOperator
- AWSTransformInfrastructureExecutorAccessEC2Operator
- AWSTransformLandingZoneAgentPolicyOperator
- AWSTransformSecurityAgentExecutorAccessOperator
- EC2FastLaunchFullAccessOperator
Service roles (7)
- AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicyOperator
- AmplifyBackendDeployFullAccessOperator
- AWSControlTowerServiceRolePolicyOperator
- AWSElasticBeanstalkServiceHigh privilegeAdmin
- AWSTransformApplicationDeploymentPolicyOperator
- AWSTransformApplicationECSDeploymentPolicyOperator
- ServerMigration_ServiceRoleOperator
Service-linked roles (17)
- AmazonSSMServiceRolePolicyOperator
- AWSCloud9ServiceRolePolicyOperator
- AWSCODAServiceRolePolicyReader
- AWSControlTowerAccountServiceRolePolicyOperator
- AWSElasticBeanstalkMaintenanceOperator
- AWSElasticBeanstalkManagedUpdatesServiceRolePolicyAdmin
- AWSManagedServices_DetectiveControlsConfig_ServiceRolePolicyOperator
- AWSManagedServicesDeploymentToolkitPolicyOperator
- AWSProtonCodeBuildProvisioningServiceRolePolicyOperator
- AWSServiceCatalogAppRegistryServiceRolePolicyOperator
- AWSServiceCatalogSyncServiceRolePolicyOperator
- AWSServiceRoleForSMSOperator
- AWSWellArchitectedDiscoveryServiceRolePolicyOperator
- CloudFormationStackSetsOrgMemberServiceRolePolicyOperator
- ConfigConformsServiceRolePolicyOperator
- ResourceGroupsServiceRolePolicyReader
- SSMQuickSetupRolePolicyOperator
Also grants CloudFormation actions (87)
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDevOpsGuruConsoleFullAccess
- AmazonDevOpsGuruFullAccess
- AmazonDevOpsGuruReadOnlyAccess
- AmazonDevOpsGuruServiceRolePolicy
- AmazonEC2RolePolicyForLaunchWizard
- AmazonECS_FullAccess
- AmazonECSInfrastructureRolePolicyForManagedInstances
- AmazonElasticMapReduceFullAccess
- AmazonLaunchWizardFullAccessV2
- AmazonMQFullAccess
- AmazonQDeveloperAccess
- AmazonQFullAccess
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerFullAccess
- AmazonSSMAutomationRole
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSApplicationMigrationNetworkMigrationMultiAccount
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceLinkedRolePolicyForBackup
- AWSBackupServiceRolePolicyForBackup
- AWSBackupServiceRolePolicyForRestores
- AWSCODAPermissionsBoundary
- AWSCodePipeline_FullAccess
- AWSCodeStarServiceRole
- AWSConfigServiceRolePolicy
- AWSDeepRacerServiceRolePolicy
- AWSElasticBeanstalkReadOnly
- AWSElasticBeanstalkRoleCore
- AWSElasticBeanstalkServiceRolePolicy
- AWSElasticDisasterRecoveryConsoleFullAccess
- AWSElasticDisasterRecoveryConsoleFullAccess_v2
- AWSGlueConsoleFullAccess
- AWSGlueConsoleSageMakerNotebookFullAccess
- AWSLambda_FullAccess
- AWSLambda_ReadOnlyAccess
- AWSLambdaFullAccess
- AWSLicenseManagerMasterAccountRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSMigrationHubRefactorSpaces-EnvironmentsWithoutBridgesFullAccess
- AWSMigrationHubRefactorSpacesFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSQuickSetupPatchPolicyDeploymentRolePolicy
- AWSReachabilityAnalyzerServiceRolePolicy
- AWSRefactoringToolkitFullAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSResourceGroupsReadOnlyAccess
- AWSSupportServiceRolePolicy
- AWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicy
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformNetworkMigrationAgentPolicy
- AWSTrustedAdvisorServiceRolePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- CloudWatchOmniAWSIntegrationPolicy
- DataScientist
- EC2FastLaunchServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsandTagEditorFullAccess
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- ServerMigrationServiceConsoleFullAccess
- ServerMigrationServiceLaunchRole
- ServiceQuotasFullAccess
- ServiceQuotasReadOnlyAccess
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
activateorganizationsaccess activatetype batchdescribetypeconfigurations cancelresourcerequest cancelupdatestack continueupdaterollback createchangeset creategeneratedtemplate createresource createstack createstackinstances createstackrefactor createstackset createuploadbucket deactivateorganizationsaccess deactivatetype deletechangeset deletegeneratedtemplate deleteresource deletestack deletestackinstances deletestackset deregistertype describeaccountlimits describechangeset describechangesethooks describeevents describegeneratedtemplate describeorganizationsaccess describepublisher describeresourcescan describestackdriftdetectionstatus describestackevents describestackinstance describestackrefactor describestackresource describestackresourcedrifts describestackresources describestackset describestacksetoperation describestacks describetype describetyperegistration detectstackdrift detectstackresourcedrift detectstacksetdrift estimatetemplatecost executechangeset executestackrefactor getgeneratedtemplate gethookresult getresource getresourcerequeststatus getstackpolicy gettemplate gettemplatesummary importstackstostackset listallhookresults listchangesets listexports listgeneratedtemplates listhookresults listimports listresourcerequests listresourcescanrelatedresources listresourcescanresources listresourcescans listresources liststackinstanceresourcedrifts liststackinstances liststackrefactoractions liststackrefactors liststackresources liststacksetautodeploymenttargets liststacksetoperationresults liststacksetoperations liststacksets liststacks listtyperegistrations listtypeversions listtypes publishtype recordhandlerprogress registerpublisher registertype removealias rollbackstack setalias setstackpolicy settypeconfiguration settypedefaultversion signalresource startresourcescan stopstacksetoperation tagresource testtype untagresource updategeneratedtemplate updateresource updatestack updatestackinstances updatestackset updateterminationprotection validatetemplate
Actions (104)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| cloudformation:ActivateOrganizationsAccess | Write | 7 | 7 |
| cloudformation:ActivateType | Write | 6 | 9 |
| cloudformation:BatchDescribeTypeConfigurations | Read | 16 | 8 |
| cloudformation:CancelResourceRequest | Write | 6 | 7 |
| cloudformation:CancelUpdateStack | Write | 6 | 11 |
| cloudformation:ContinueUpdateRollback | Write | 6 | 9 |
| cloudformation:CreateChangeSet | Write | 7 | 28 |
| cloudformation:CreateGeneratedTemplate | Write | 6 | 7 |
| cloudformation:CreateResource | Write | 6 | 7 |
| cloudformation:CreateStack | Write | 18 | 47 |
| cloudformation:CreateStackInstances | Write | 6 | 12 |
| cloudformation:CreateStackRefactor | Write | 6 | 8 |
| cloudformation:CreateStackSet | Write | 6 | 12 |
| cloudformation:CreateUploadBucket | Write | 7 | 7 |
| cloudformation:DeactivateOrganizationsAccess | Write | 6 | 7 |
| cloudformation:DeactivateType | Write | 6 | 9 |
| cloudformation:DeleteChangeSet | Write | 6 | 23 |
| cloudformation:DeleteGeneratedTemplate | Write | 6 | 7 |
| cloudformation:DeleteResource | Write | 6 | 7 |
| cloudformation:DeleteStack | Write | 9 | 49 |
| cloudformation:DeleteStackInstances | Write | 6 | 14 |
| cloudformation:DeleteStackSet | Write | 6 | 15 |
| cloudformation:DeregisterType | Write | 6 | 7 |
| cloudformation:DescribeAccountLimits | Read | 23 | 7 |
| cloudformation:DescribeChangeSet | Read | 24 | 29 |
| cloudformation:DescribeChangeSetHooks | Read | 18 | 9 |
| cloudformation:DescribeEvents | Read | 17 | 9 |
| cloudformation:DescribeGeneratedTemplate | Read | 17 | 9 |
| cloudformation:DescribeOrganizationsAccess | Read | 17 | 9 |
| cloudformation:DescribePublisher | Read | 22 | 10 |
| cloudformation:DescribeResourceScan | Read | 17 | 9 |
| cloudformation:DescribeStackDriftDetectionStatus | Read | 26 | 12 |
| cloudformation:DescribeStackEvents | Read | 27 | 42 |
| cloudformation:DescribeStackInstance | Read | 24 | 22 |
| cloudformation:DescribeStackRefactor | Read | 18 | 13 |
| cloudformation:DescribeStackResource | Read | 24 | 20 |
| cloudformation:DescribeStackResourceDrifts | Read | 20 | 17 |
| cloudformation:DescribeStackResources | Read | 27 | 28 |
| cloudformation:DescribeStackSet | Read | 24 | 24 |
| cloudformation:DescribeStackSetOperation | Read | 20 | 22 |
| cloudformation:DescribeStacks | List | 69 | 51 |
| cloudformation:DescribeType | Read | 22 | 11 |
| cloudformation:DescribeTypeRegistration | Read | 18 | 9 |
| cloudformation:DetectStackDrift | Read | 9 | 12 |
| cloudformation:DetectStackResourceDrift | Read | 8 | 12 |
| cloudformation:DetectStackSetDrift | Read | 8 | 8 |
| cloudformation:EstimateTemplateCost | Read | 13 | 7 |
| cloudformation:ExecuteChangeSet | Write | 7 | 25 |
| cloudformation:ExecuteStackRefactor | Write | 6 | 8 |
| cloudformation:GetGeneratedTemplate | Read | 11 | 9 |
| cloudformation:GetHookResult | Read | 10 | 9 |
| cloudformation:GetResource | Read | 21 | 11 |
| cloudformation:GetResourceRequestStatus | Read | 10 | 9 |
| cloudformation:GetStackPolicy | Read | 21 | 13 |
| cloudformation:GetTemplate | Read | 24 | 26 |
| cloudformation:GetTemplateSummary | Read | 26 | 16 |
| cloudformation:ImportStacksToStackSet | Write | 6 | 8 |
| cloudformation:ListAllHookResults | List | 19 | 7 |
| cloudformation:ListChangeSets | List | 25 | 13 |
| cloudformation:ListExports | List | 21 | 7 |
| cloudformation:ListGeneratedTemplates | List | 20 | 7 |
| cloudformation:ListHookResults | List | 19 | 7 |
| cloudformation:ListImports | List | 22 | 7 |
| cloudformation:ListResourceRequests | Read | 19 | 7 |
| cloudformation:ListResourceScanRelatedResources | List | 20 | 7 |
| cloudformation:ListResourceScanResources | List | 20 | 7 |
| cloudformation:ListResourceScans | List | 20 | 7 |
| cloudformation:ListResources | Read | 26 | 9 |
| cloudformation:ListStackInstanceResourceDrifts | List | 20 | 8 |
| cloudformation:ListStackInstances | List | 26 | 19 |
| cloudformation:ListStackRefactorActions | List | 20 | 8 |
| cloudformation:ListStackRefactors | List | 20 | 8 |
| cloudformation:ListStackResources | List | 45 | 26 |
| cloudformation:ListStackSetAutoDeploymentTargets | List | 20 | 9 |
| cloudformation:ListStackSetOperationResults | List | 22 | 15 |
| cloudformation:ListStackSetOperations | List | 22 | 16 |
| cloudformation:ListStackSets | List | 28 | 11 |
| cloudformation:ListStacks | List | 54 | 21 |
| cloudformation:ListTypeRegistrations | List | 21 | 7 |
| cloudformation:ListTypeVersions | List | 22 | 8 |
| cloudformation:ListTypes | List | 25 | 9 |
| cloudformation:PublishType | Write | 6 | 7 |
| cloudformation:RecordHandlerProgress | Write | 6 | 7 |
| cloudformation:RegisterPublisher | Write | 6 | 7 |
| cloudformation:RegisterType | Write | 6 | 7 |
| cloudformation:RemoveAlias | Write | 6 | 7 |
| cloudformation:RollbackStack | Write | 6 | 9 |
| cloudformation:SetAlias | Write | 6 | 7 |
| cloudformation:SetStackPolicy | Permissions management | 6 | 12 |
| cloudformation:SetTypeConfiguration | Write | 6 | 9 |
| cloudformation:SetTypeDefaultVersion | Write | 6 | 7 |
| cloudformation:SignalResource | Write | 6 | 11 |
| cloudformation:StartResourceScan | Write | 6 | 7 |
| cloudformation:StopStackSetOperation | Write | 6 | 8 |
| cloudformation:TagResource | Tagging | 7 | 52 |
| cloudformation:TestType | Write | 6 | 7 |
| cloudformation:UntagResource | Tagging | 7 | 43 |
| cloudformation:UpdateGeneratedTemplate | Write | 6 | 7 |
| cloudformation:UpdateResource | Write | 6 | 7 |
| cloudformation:UpdateStack | Write | 8 | 40 |
| cloudformation:UpdateStackInstances | Write | 6 | 11 |
| cloudformation:UpdateStackSet | Write | 6 | 13 |
| cloudformation:UpdateTerminationProtection | Write | 6 | 16 |
| cloudformation:ValidateTemplate | Read | 25 | 5 |