Directory Service
Prefix ds, 91 actions · Domain Security, Identity & Compliance
11 AWS managed policies. 4 have reviewed guidance; the rest have authoritative permission data pending editorial review. 2 are service-linked role policies, shown with permission data only.
User access (5)
Operator and limited (3)
- AmazonSSMDirectoryServiceAccessOperator
- AWSDirectoryServiceDataReadOnlyAccessOperator
- AWSIdentitySyncFullAccessOperator
Service roles (1)
- AmazonRDSDirectoryServiceAccessOperator
Service-linked roles (2)
Also grants Directory Service actions (48)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonAppStreamServiceAccess
- AmazonConnect_FullAccess
- AmazonConnectReadOnlyAccess
- AmazonEC2RoleforSSM
- AmazonFSxConsoleFullAccess
- AmazonFSxConsoleReadOnlyAccess
- AmazonFSxFullAccess
- AmazonFSxServiceRolePolicy
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonMonitronFullAccess
- AmazonNimbleStudio-StudioAdmin
- AmazonNimbleStudio-StudioUser
- AmazonSSMFullAccess
- AmazonWorkDocsFullAccess
- AmazonWorkDocsReadOnlyAccess
- AmazonWorkMailFullAccess
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceRolePolicyForRestores
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSDirectoryServiceDataFullAccess
- AWSMcpServiceActionsFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSRefactoringToolkitFullAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSSOMasterAccountAdministrator
- AWSSSOMemberAccountAdministrator
- AWSSSOReadOnly
- AWSSSOServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- SecurityAudit
- SupportUser
- SystemAdministrator
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
acceptshareddirectory accessdsdata addiproutes addregion addtagstoresource authorizeapplication cancelschemaextension checkalias connectdirectory createalias createcomputer createconditionalforwarder createdirectory createhybridad createidentitypooldirectory createlogsubscription createmicrosoftad createsnapshot createtrust deleteadassessment deleteconditionalforwarder deletedirectory deletelogsubscription deletesnapshot deletetrust deregistercertificate deregistereventtopic describeadassessment describecaenrollmentpolicy describecertificate describeclientauthenticationsettings describeconditionalforwarders describedirectories describedirectorydataaccess describedomaincontrollers describeeventtopics describehybridadupdate describeldapssettings describeregions describesettings describeshareddirectories describesnapshots describetrusts describeupdatedirectory disablecaenrollmentpolicy disableclientauthentication disabledirectorydataaccess disableldaps disableradius disableroleaccess disablesso enablecaenrollmentpolicy enableclientauthentication enabledirectorydataaccess enableldaps enableradius enableroleaccess enablesso getauthorizedapplicationdetails getdirectorylimits getsnapshotlimits listadassessments listauthorizedapplications listcertificates listiproutes listlogsubscriptions listschemaextensions listtagsforresource registercertificate registereventtopic rejectshareddirectory removeiproutes removeregion removetagsfromresource resetuserpassword restorefromsnapshot sharedirectory startadassessment startschemaextension unauthorizeapplication unsharedirectory updateauthorizedapplication updateconditionalforwarder updatedirectory updatedirectorysetup updatehybridad updatenumberofdomaincontrollers updateradius updatesettings updatetrust verifytrust
Actions (91)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| ds:AcceptSharedDirectory | Write | 7 | 1 |
| ds:AccessDSData | Permissions management | 7 | 3 |
| ds:AddIpRoutes | Write | 7 | 3 |
| ds:AddRegion | Write | 7 | 1 |
| ds:AddTagsToResource | Tagging | 7 | 1 |
| ds:AuthorizeApplication | Write | 14 | 2 |
| ds:CancelSchemaExtension | Write | 7 | 1 |
| ds:CheckAlias | Read | 11 | 1 |
| ds:ConnectDirectory | Write | 7 | 1 |
| ds:CreateAlias | Write | 11 | 1 |
| ds:CreateComputer | Write | 10 | 5 |
| ds:CreateConditionalForwarder | Write | 7 | 1 |
| ds:CreateDirectory | Write | 8 | 1 |
| ds:CreateHybridAD | Write | 7 | 1 |
| ds:CreateIdentityPoolDirectory | Write | 9 | 1 |
| ds:CreateLogSubscription | Write | 7 | 1 |
| ds:CreateMicrosoftAD | Write | 7 | 3 |
| ds:CreateSnapshot | Write | 7 | 1 |
| ds:CreateTrust | Write | 7 | 1 |
| ds:DeleteADAssessment | Write | 7 | 1 |
| ds:DeleteConditionalForwarder | Write | 7 | 1 |
| ds:DeleteDirectory | Write | 9 | 3 |
| ds:DeleteLogSubscription | Write | 7 | 1 |
| ds:DeleteSnapshot | Write | 7 | 1 |
| ds:DeleteTrust | Write | 7 | 1 |
| ds:DeregisterCertificate | Write | 7 | 1 |
| ds:DeregisterEventTopic | Write | 7 | 1 |
| ds:DescribeADAssessment | Read | 16 | 1 |
| ds:DescribeCAEnrollmentPolicy | Read | 16 | 1 |
| ds:DescribeCertificate | Read | 16 | 1 |
| ds:DescribeClientAuthenticationSettings | Read | 17 | 1 |
| ds:DescribeConditionalForwarders | Read | 17 | 1 |
| ds:DescribeDirectories | List | 49 | 6 |
| ds:DescribeDirectoryDataAccess | Read | 16 | 1 |
| ds:DescribeDomainControllers | Read | 20 | 1 |
| ds:DescribeEventTopics | Read | 20 | 1 |
| ds:DescribeHybridADUpdate | Read | 16 | 1 |
| ds:DescribeLDAPSSettings | Read | 17 | 1 |
| ds:DescribeRegions | Read | 16 | 1 |
| ds:DescribeSettings | Read | 16 | 1 |
| ds:DescribeSharedDirectories | Read | 17 | 1 |
| ds:DescribeSnapshots | Read | 18 | 1 |
| ds:DescribeTrusts | Read | 23 | 1 |
| ds:DescribeUpdateDirectory | Read | 16 | 1 |
| ds:DisableCAEnrollmentPolicy | Write | 7 | 1 |
| ds:DisableClientAuthentication | Write | 7 | 1 |
| ds:DisableDirectoryDataAccess | Write | 7 | 1 |
| ds:DisableLDAPS | Write | 7 | 1 |
| ds:DisableRadius | Write | 7 | 1 |
| ds:DisableRoleAccess | Write | 7 | 1 |
| ds:DisableSso | Write | 7 | 1 |
| ds:EnableCAEnrollmentPolicy | Write | 7 | 1 |
| ds:EnableClientAuthentication | Write | 7 | 1 |
| ds:EnableDirectoryDataAccess | Write | 7 | 1 |
| ds:EnableLDAPS | Write | 7 | 1 |
| ds:EnableRadius | Write | 7 | 1 |
| ds:EnableRoleAccess | Write | 7 | 1 |
| ds:EnableSso | Write | 7 | 1 |
| ds:GetAuthorizedApplicationDetails | Read | 12 | 1 |
| ds:GetDirectoryLimits | Read | 14 | 1 |
| ds:GetSnapshotLimits | Read | 12 | 1 |
| ds:ListADAssessments | List | 10 | 1 |
| ds:ListAuthorizedApplications | Read | 13 | 1 |
| ds:ListCertificates | List | 10 | 1 |
| ds:ListIpRoutes | Read | 11 | 1 |
| ds:ListLogSubscriptions | Read | 13 | 1 |
| ds:ListSchemaExtensions | List | 11 | 1 |
| ds:ListTagsForResource | Read | 15 | 2 |
| ds:RegisterCertificate | Write | 7 | 1 |
| ds:RegisterEventTopic | Write | 7 | 1 |
| ds:RejectSharedDirectory | Write | 7 | 1 |
| ds:RemoveIpRoutes | Write | 7 | 1 |
| ds:RemoveRegion | Write | 7 | 1 |
| ds:RemoveTagsFromResource | Tagging | 7 | 1 |
| ds:ResetUserPassword | Write | 7 | 1 |
| ds:RestoreFromSnapshot | Write | 7 | 1 |
| ds:ShareDirectory | Write | 7 | 1 |
| ds:StartADAssessment | Write | 7 | 1 |
| ds:StartSchemaExtension | Write | 7 | 1 |
| ds:UnauthorizeApplication | Write | 15 | 2 |
| ds:UnshareDirectory | Write | 7 | 1 |
| ds:UpdateAuthorizedApplication | Write | 7 | 1 |
| ds:UpdateConditionalForwarder | Write | 7 | 1 |
| ds:UpdateDirectory | Write | 7 | 1 |
| ds:UpdateDirectorySetup | Write | 7 | 1 |
| ds:UpdateHybridAD | Write | 7 | 1 |
| ds:UpdateNumberOfDomainControllers | Write | 7 | 1 |
| ds:UpdateRadius | Write | 7 | 1 |
| ds:UpdateSettings | Write | 7 | 1 |
| ds:UpdateTrust | Write | 7 | 1 |
| ds:VerifyTrust | Read | 9 | 1 |