IAM

Prefix iam, 190 actions · Domain Security, Identity & Compliance

116 AWS managed policies. 8 have reviewed guidance; the rest have authoritative permission data pending editorial review. 40 are service-linked role policies, shown with permission data only.

User access (12)

AmazonCodeGuruProfilerFullAccessAdmin
AmazonCodeGuruProfilerReadOnlyAccessReader
AmazonEKSMCPReadOnlyAccessAnalyst
AmazonKinesisAnalyticsReadOnlyReader
AWSArtifactAgreementsReadOnlyAccessReader
AWSBudgetsActionsWithAWSResourceControlAccessAdmin
AWSDataPipeline_PowerUserAdmin
AWSGrafanaAccountAdministratorAdmin
AWSSupportPlansFullAccessAdmin
IAMAccessAdvisorReadOnlyReader
IAMFullAccessHigh privilegeAdmin
IAMReadOnlyAccessReader

Operator and limited (50)

AccountManagementFromVercelOperator
AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicyOperator
AmazonCloudWatchEvidentlyFullAccessOperator
AmazonDataZonePreviewConsoleFullAccessOperator
AmazonDataZoneRedshiftGlueProvisioningPolicyOperator
AmazonDataZoneSageMakerProvisioningRolePolicyOperator
AmazonEKSComputePolicyOperator
AWS-SSM-DiagnosisAutomation-ExecutionRolePolicyOperator
AWSArtifactAgreementsFullAccessOperator
AWSBackupServiceRolePolicyForScansOperator
AWSCleanRoomsFullAccessNoQueryingOperator
AWSCloud9EnvironmentMemberOperator
AWSCloud9UserOperator
AWSElementalMediaConnectCreateFlowOperator
AWSIotRoboRunnerFullAccessOperator
AWSKeyManagementServicePowerUserOperator
AWSManagedAccountManagementAccessOperator
AWSManagedAdvancedFeaturesActivationAccessOperator
AWSMarketplaceImageBuildFullAccessOperator
AWSQuickSetupCFGCPacksPermissionsBoundaryOperator
AWSQuickSetupDeploymentRolePolicyOperator
AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
AWSQuickSetupDistributorPermissionsBoundaryOperator
AWSQuickSetupEnableDHMCExecutionPolicyOperator
AWSQuickSetupJITNADeploymentRolePolicyOperator
AWSQuickSetupManagedInstanceProfileExecutionPolicyOperator
AWSQuickSetupManageJITNAResourcesExecutionPolicyOperator
AWSQuickSetupPatchPolicyLambdaExecutionPolicyOperator
AWSQuickSetupSchedulerPermissionsBoundaryOperator
AWSQuickSetupSSMDeploymentRolePolicyOperator
AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator
AWSQuickSetupSSMLifecycleManagementExecutionPolicyOperator
AWSQuickSetupSSMManageResourcesExecutionPolicyOperator
AWSQuickSetupStartSSMAssociationsExecutionPolicyOperator
AWSQuickSetupStartStopInstancesExecutionPolicyOperator
AWSResilienceHubResilienceTestingPolicyOperator
AWSSystemsManagerEnableConfigRecordingExecutionPolicyOperator
AWSSystemsManagerEnableExplorerExecutionPolicyOperator
AWSThinkboxDeadlineSpotEventPluginAdminPolicyOperator
AWSTransformCustomExecuteTransformationsOperator
AWSTransformInfrastructureExecutorAccessEC2Operator
CloudWatchOpenSearchDashboardAccessOperator
CloudWatchOpenSearchDashboardsFullAccessOperator
CostOptimizationHubAdminAccessOperator
DBModDiscoveryAndAssessmentOperator
IAMSelfManageServiceSpecificCredentialsOperator
IAMUserChangePasswordOperator
IAMUserSSHKeysOperator
PartnerCentralAccountManagementUserRoleAssociationOperator
SageMakerStudioUserIAMConsolePolicyOperator

Service roles (14)

AmazonEC2ContainerServiceEventsRoleOperator
AmazonEC2SpotFleetAutoscaleRoleOperator
AmazonEC2SpotFleetTaggingRoleOperator
AmazonMacieHandshakeRoleOperator
AmazonSageMakerEdgeDeviceFleetPolicyOperator
AWSFaultInjectionSimulatorSSMAccessOperator
AWSIoTDeviceDefenderAuditReader
AWSIoTDeviceDefenderEnableIoTLoggingMitigationActionOperator
AWSQuickSightListIAMReader
AWSTransformApplicationDeploymentPolicyOperator
AWSTransformApplicationECSDeploymentPolicyOperator
ROSAInstallerPolicyOperator
ROSAKarpenterControllerPolicyOperator
SageMakerStudioEMRServiceRolePolicyOperator

Service-linked roles (40)

AccessAnalyzerServiceRolePolicyReader
AmazonChimeServiceRolePolicyOperator
AmazonEKSConnectorServiceRolePolicyOperator
AmazonEKSLocalOutpostServiceRolePolicyOperator
AmazonFISServiceRolePolicyOperator
AWSApplicationAutoscalingRDSClusterPolicyOperator
AWSAuditManagerServiceRolePolicyOperator
AWSBatchServiceRolePolicyForSageMakerOperator
AWSBedrockAgentCoreGatewayNetworkServiceRolePolicyOperator
AWSBedrockAgentCoreIdentityNetworkServiceRolePolicyOperator
AWSCloud9ServiceRolePolicyOperator
AWSCloudWatchOmniServiceRolePolicyOperator
AWSConfigMultiAccountSetupPolicyOperator
AWSConfigRemediationServiceRolePolicyOperator
AWSEC2FleetServiceRolePolicyOperator
AWSEC2SpotFleetServiceRolePolicyOperator
AWSEC2SpotServiceRolePolicyOperator
AWSIAMRoleManagerServiceRolePolicyOperator
AWSIQPermissionServiceRolePolicyOperator
AWSLambdaReplicatorOperator
AWSManagedServices_ContactsServiceRolePolicyReader
AWSObservabilityAdminServiceRolePolicyOperator
AWSOrganizationsServiceTrustPolicyOperator
AWSResourceAccessManagerServiceRolePolicyOperator
AWSSDMPServiceRolePolicyOperator
AWSSecurityAgentServiceRolePolicyOperator
AWSSecurityHubV2ServiceRolePolicyOperator
AWSServiceRoleForAIDevOpsPolicyOperator
AWSServiceRoleForAmazonEKSNodegroupOperator
AWSSSOServiceRolePolicyOperator
AWSSystemsManagerChangeManagementServicePolicyOperator
AWSSystemsManagerNotificationsServicePolicyReader
AWSUserAttributeCostAllocationPolicyReader
CloudFormationStackSetsOrgMemberServiceRolePolicyOperator
ConfigConformsServiceRolePolicyOperator
CustomerProfilesServiceLinkedRolePolicyOperator
DynamoDBGlobalTableSettingsManagementServiceRolePolicyOperator
EC2FleetTimeShiftableServiceRolePolicyOperator
FSxDeleteServiceLinkedRoleAccessOperator
LightsailExportAccessOperator

Also grants IAM actions (380)

acceptdelegationrequest addclientidtoopenidconnectprovider addroletoinstanceprofile addusertogroup associatedelegationrequest attachgrouppolicy attachrolepolicy attachuserpolicy changepassword createaccesskey createaccountalias createdelegationrequest creategroup createinstanceprofile createloginprofile createopenidconnectprovider createpolicy createpolicyversion createrole createsamlprovider createservicelinkedrole createservicespecificcredential createuser createvirtualmfadevice deactivatemfadevice deleteaccesskey deleteaccountalias deleteaccountpasswordpolicy deletecloudfrontpublickey deletegroup deletegrouppolicy deleteinstanceprofile deleteloginprofile deleteopenidconnectprovider deletepolicy deletepolicyversion deleterole deleterolepermissionsboundary deleterolepolicy deletesamlprovider deletesshpublickey deleteservercertificate deleteservicelinkedrole deleteservicespecificcredential deletesigningcertificate deleteuser deleteuserpermissionsboundary deleteuserpolicy deletevirtualmfadevice detachgrouppolicy detachrolepolicy detachuserpolicy disableorganizationsrootcredentialsmanagement disableorganizationsrootsessions disableoutboundwebidentityfederation enablemfadevice enableorganizationsrootcredentialsmanagement enableorganizationsrootsessions enableoutboundwebidentityfederation generatecredentialreport generateorganizationsaccessreport generateservicelastaccesseddetails getaccesskeylastused getaccountauthorizationdetails getaccountemailaddress getaccountname getaccountpasswordpolicy getaccountproperties getaccountsummary getcloudfrontpublickey getcontextkeysforcustompolicy getcontextkeysforprincipalpolicy getcredentialreport getdelegationrequest getgroup getgrouppolicy gethumanreadablesummary getinstanceprofile getloginprofile getmfadevice getopenidconnectprovider getorganizationsaccessreport getoutboundwebidentityfederationinfo getpolicy getpolicyversion getrole getrolepolicy getroletemplateversion getsamlprovider getsshpublickey getservercertificate getservicelastaccesseddetails getservicelastaccesseddetailswithentities getservicelinkedroledeletionstatus getuser getuserpolicy listaccesskeys listaccountaliases listattachedgrouppolicies listattachedrolepolicies listattacheduserpolicies listcloudfrontpublickeys listdelegationrequests listentitiesforpolicy listgrouppolicies listgroups listgroupsforuser listinstanceprofiletags listinstanceprofiles listinstanceprofilesforrole listmfadevicetags listmfadevices listopenidconnectprovidertags listopenidconnectproviders listorganizationsfeatures listpolicies listpoliciesgrantingserviceaccess listpolicytags listpolicyversions listrolepolicies listroletags listroles listsamlprovidertags listsamlproviders listsshpublickeys liststsregionalendpointsstatus listservercertificatetags listservercertificates listservicespecificcredentials listsigningcertificates listuserpolicies listusertags listusers listvirtualmfadevices passrole putaccountproperties putgrouppolicy putrolepermissionsboundary putrolepolicy putuserpermissionsboundary putuserpolicy rejectdelegationrequest removeclientidfromopenidconnectprovider removerolefrominstanceprofile removeuserfromgroup resetservicespecificcredential resyncmfadevice senddelegationtoken setdefaultpolicyversion setstsregionalendpointstatus setsecuritytokenservicepreferences simulatecustompolicy simulateprincipalpolicy taginstanceprofile tagmfadevice tagopenidconnectprovider tagpolicy tagrole tagsamlprovider tagservercertificate taguser untaginstanceprofile untagmfadevice untagopenidconnectprovider untagpolicy untagrole untagsamlprovider untagservercertificate untaguser updateaccesskey updateaccountemailaddress updateaccountname updateaccountpasswordpolicy updateassumerolepolicy updatecloudfrontpublickey updategroup updateloginprofile updateopenidconnectproviderthumbprint updaterole updateroledescription updatesamlprovider updatesshpublickey updateservercertificate updateservicespecificcredential updatesigningcertificate updateuser uploadcloudfrontpublickey uploadsshpublickey uploadservercertificate uploadsigningcertificate

Actions (190)

IAM actions that managed policies grant
Action	Access level	Policies granting without limits	Policies granting with resource or condition limits
iam:AcceptDelegationRequest	Write	3	1
iam:AddClientIDToOpenIDConnectProvider	Write	3	1
iam:AddRoleToInstanceProfile	Write	6	11
iam:AddUserToGroup	Write	3	1
iam:AssociateDelegationRequest	Write	3	1
iam:AttachGroupPolicy	Permissions management	3	1
iam:AttachRolePolicy	Permissions management	4	33
iam:AttachUserPolicy	Permissions management	3	2
iam:ChangePassword	Write	3	2
iam:CreateAccessKey	Write	3	1
iam:CreateAccountAlias	Write	3	1
iam:CreateDelegationRequest	Write	3	1
iam:CreateGroup	Write	3	1
iam:CreateInstanceProfile	Write	3	14
iam:CreateLoginProfile	Write	3	1
iam:CreateOpenIDConnectProvider	Write	3	1
iam:CreatePolicy	Permissions management	5	6
iam:CreatePolicyVersion	Permissions management	4	4
iam:CreateRole	Write	3	33
iam:CreateSAMLProvider	Write	3	2
iam:CreateServiceLinkedRole	Write	6	232
iam:CreateServiceSpecificCredential	Write	3	4
iam:CreateUser	Write	2	2
iam:CreateVirtualMFADevice	Write	3	1
iam:DeactivateMFADevice	Write	3	1
iam:DeleteAccessKey	Write	3	1
iam:DeleteAccountAlias	Write	3	1
iam:DeleteAccountPasswordPolicy	Permissions management	3	1
iam:DeleteCloudFrontPublicKey	Write	3	1
iam:DeleteGroup	Write	3	1
iam:DeleteGroupPolicy	Permissions management	3	1
iam:DeleteInstanceProfile	Write	3	10
iam:DeleteLoginProfile	Write	3	1
iam:DeleteOpenIDConnectProvider	Write	3	1
iam:DeletePolicy	Permissions management	3	6
iam:DeletePolicyVersion	Permissions management	4	5
iam:DeleteRole	Write	4	29
iam:DeleteRolePermissionsBoundary	Permissions management	2	4
iam:DeleteRolePolicy	Permissions management	4	16
iam:DeleteSAMLProvider	Write	3	2
iam:DeleteSSHPublicKey	Write	3	4
iam:DeleteServerCertificate	Write	3	1
iam:DeleteServiceLinkedRole	Write	4	21
iam:DeleteServiceSpecificCredential	Write	3	4
iam:DeleteSigningCertificate	Write	3	1
iam:DeleteUser	Write	3	1
iam:DeleteUserPermissionsBoundary	Permissions management	3	1
iam:DeleteUserPolicy	Permissions management	3	1
iam:DeleteVirtualMFADevice	Write	3	1
iam:DetachGroupPolicy	Permissions management	3	1
iam:DetachRolePolicy	Permissions management	4	22
iam:DetachUserPolicy	Permissions management	3	2
iam:DisableOrganizationsRootCredentialsManagement	Write	3	1
iam:DisableOrganizationsRootSessions	Write	3	1
iam:DisableOutboundWebIdentityFederation	Write	3	1
iam:EnableMFADevice	Write	3	1
iam:EnableOrganizationsRootCredentialsManagement	Write	3	1
iam:EnableOrganizationsRootSessions	Write	3	1
iam:EnableOutboundWebIdentityFederation	Write	4	1
iam:GenerateCredentialReport	Read	14	2
iam:GenerateOrganizationsAccessReport	Read	5	1
iam:GenerateServiceLastAccessedDetails	Read	10	1
iam:GetAccessKeyLastUsed	Read	13	2
iam:GetAccountAuthorizationDetails	Read	16	1
iam:GetAccountEmailAddress	Read	9	1
iam:GetAccountName	Read	9	1
iam:GetAccountPasswordPolicy	Read	17	2
iam:GetAccountProperties	Read	9	1
iam:GetAccountSummary	List	20	2
iam:GetCloudFrontPublicKey	Read	8	1
iam:GetContextKeysForCustomPolicy	Read	11	1
iam:GetContextKeysForPrincipalPolicy	Read	11	1
iam:GetCredentialReport	Read	17	2
iam:GetDelegationRequest	Read	8	1
iam:GetGroup	Read	20	3
iam:GetGroupPolicy	Read	17	3
iam:GetHumanReadableSummary	Read	8	1
iam:GetInstanceProfile	Read	38	16
iam:GetLoginProfile	List	15	3
iam:GetMFADevice	Read	9	1
iam:GetOpenIDConnectProvider	Read	18	3
iam:GetOrganizationsAccessReport	Read	9	1
iam:GetOutboundWebIdentityFederationInfo	Read	9	1
iam:GetPolicy	Read	36	20
iam:GetPolicyVersion	Read	35	14
iam:GetRole	Read	87	89
iam:GetRolePolicy	Read	46	26
iam:GetRoleTemplateVersion	Read	9	3
iam:GetSAMLProvider	Read	18	5
iam:GetSSHPublicKey	Read	11	5
iam:GetServerCertificate	Read	17	3
iam:GetServiceLastAccessedDetails	Read	12	1
iam:GetServiceLastAccessedDetailsWithEntities	Read	10	1
iam:GetServiceLinkedRoleDeletionStatus	Read	12	21
iam:GetUser	Read	39	3
iam:GetUserPolicy	Read	18	4
iam:ListAccessKeys	List	21	5
iam:ListAccountAliases	List	19	2
iam:ListAttachedGroupPolicies	List	20	3
iam:ListAttachedRolePolicies	List	45	30
iam:ListAttachedUserPolicies	List	21	3
iam:ListCloudFrontPublicKeys	List	13	1
iam:ListDelegationRequests	List	13	1
iam:ListEntitiesForPolicy	List	22	5
iam:ListGroupPolicies	List	20	3
iam:ListGroups	List	28	3
iam:ListGroupsForUser	List	21	3
iam:ListInstanceProfileTags	List	16	1
iam:ListInstanceProfiles	List	37	5
iam:ListInstanceProfilesForRole	List	23	2
iam:ListMFADeviceTags	List	17	1
iam:ListMFADevices	List	20	2
iam:ListOpenIDConnectProviderTags	List	13	1
iam:ListOpenIDConnectProviders	List	25	3
iam:ListOrganizationsFeatures	List	13	1
iam:ListPolicies	List	32	4
iam:ListPoliciesGrantingServiceAccess	List	15	1
iam:ListPolicyTags	List	14	1
iam:ListPolicyVersions	List	24	8
iam:ListRolePolicies	List	42	25
iam:ListRoleTags	List	16	8
iam:ListRoles	List	146	11
iam:ListSAMLProviderTags	List	13	1
iam:ListSAMLProviders	List	25	3
iam:ListSSHPublicKeys	List	16	5
iam:ListSTSRegionalEndpointsStatus	List	13	1
iam:ListServerCertificateTags	List	13	1
iam:ListServerCertificates	List	26	3
iam:ListServiceSpecificCredentials	List	14	6
iam:ListSigningCertificates	List	16	1
iam:ListUserPolicies	List	21	3
iam:ListUserTags	List	15	2
iam:ListUsers	List	47	4
iam:ListVirtualMFADevices	List	21	3
iam:PassRole	Write	9	258
iam:PutAccountProperties	Write	4	1
iam:PutGroupPolicy	Permissions management	3	1
iam:PutRolePermissionsBoundary	Permissions management	2	7
iam:PutRolePolicy	Permissions management	4	14
iam:PutUserPermissionsBoundary	Permissions management	3	1
iam:PutUserPolicy	Permissions management	3	1
iam:RejectDelegationRequest	Write	3	1
iam:RemoveClientIDFromOpenIDConnectProvider	Write	3	1
iam:RemoveRoleFromInstanceProfile	Write	3	10
iam:RemoveUserFromGroup	Write	3	1
iam:ResetServiceSpecificCredential	Write	3	4
iam:ResyncMFADevice	Write	3	1
iam:SendDelegationToken	Write	3	1
iam:SetDefaultPolicyVersion	Permissions management	3	2
iam:SetSTSRegionalEndpointStatus	Write	3	1
iam:SetSecurityTokenServicePreferences	Write	3	1
iam:SimulateCustomPolicy	Read	8	1
iam:SimulatePrincipalPolicy	Read	9	2
iam:TagInstanceProfile	Tagging	4	3
iam:TagMFADevice	Tagging	4	1
iam:TagOpenIDConnectProvider	Tagging	4	1
iam:TagPolicy	Tagging	4	2
iam:TagRole	Tagging	4	21
iam:TagSAMLProvider	Tagging	4	1
iam:TagServerCertificate	Tagging	4	1
iam:TagUser	Tagging	4	1
iam:UntagInstanceProfile	Tagging	4	1
iam:UntagMFADevice	Tagging	4	1
iam:UntagOpenIDConnectProvider	Tagging	4	1
iam:UntagPolicy	Tagging	4	1
iam:UntagRole	Tagging	4	7
iam:UntagSAMLProvider	Tagging	4	1
iam:UntagServerCertificate	Tagging	4	1
iam:UntagUser	Tagging	4	1
iam:UpdateAccessKey	Write	3	1
iam:UpdateAccountEmailAddress	Write	3	1
iam:UpdateAccountName	Write	3	1
iam:UpdateAccountPasswordPolicy	Write	3	1
iam:UpdateAssumeRolePolicy	Permissions management	4	6
iam:UpdateCloudFrontPublicKey	Write	3	1
iam:UpdateGroup	Write	3	1
iam:UpdateLoginProfile	Write	3	1
iam:UpdateOpenIDConnectProviderThumbprint	Write	3	1
iam:UpdateRole	Write	3	11
iam:UpdateRoleDescription	Write	3	3
iam:UpdateSAMLProvider	Write	3	3
iam:UpdateSSHPublicKey	Write	3	4
iam:UpdateServerCertificate	Write	4	1
iam:UpdateServiceSpecificCredential	Write	3	4
iam:UpdateSigningCertificate	Write	4	1
iam:UpdateUser	Write	3	1
iam:UploadCloudFrontPublicKey	Write	4	1
iam:UploadSSHPublicKey	Write	4	4
iam:UploadServerCertificate	Write	4	1
iam:UploadSigningCertificate	Write	4	1