Resource Group Tagging
Prefix tag, 9 actions · Domain Management & Governance
14 AWS managed policies. 3 have reviewed guidance; the rest have authoritative permission data pending editorial review. 6 are service-linked role policies, shown with permission data only.
User access (4)
Operator and limited (1)
- ROSASharedVPCRoute53PolicyOperator
Service roles (3)
- AWSFaultInjectionSimulatorEKSAccessOperator
- AWSFaultInjectionSimulatorRDSAccessOperator
- ROSAIngressOperatorPolicyOperator
Service-linked roles (6)
Also grants Resource Group Tagging actions (93)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AmazonAuroraDSQLConsoleFullAccess
- AmazonDataZoneEnvironmentRolePermissionsBoundary
- AmazonDataZoneProjectRolePermissionsBoundary
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDevOpsGuruServiceRolePolicy
- AmazonDynamoDBFullAccess
- AmazonDynamoDBFullAccess_v2
- AmazonDynamoDBReadOnlyAccess
- AmazonECSInfrastructureRolePolicyForManagedInstances
- AmazonEKSServiceRolePolicy
- AmazonElasticFileSystemServiceRolePolicy
- AmazonFISServiceRolePolicy
- AmazonGrafanaCloudWatchAccess
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonLookoutVisionConsoleFullAccess
- AmazonPrometheusConsoleFullAccess
- AmazonRDSDataFullAccess
- AmazonRedshiftQueryEditorV2FullAccess
- AmazonRedshiftQueryEditorV2NoSharing
- AmazonRedshiftQueryEditorV2ReadSharing
- AmazonRedshiftQueryEditorV2ReadWriteSharing
- AmazonRoute53FullAccess
- AmazonSageMakerFullAccess
- AmazonSageMakerModelRegistryFullAccess
- AmazonSSMMaintenanceWindowRole
- AmazonSSMServiceRolePolicy
- AmazonVPCNetworkAccessAnalyzerFullAccessPolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAuditManagerAdministratorAccess
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceLinkedRolePolicyForBackup
- AWSBackupServiceRolePolicyForBackup
- AWSCODAPermissionsBoundary
- AWSCodeDeployRole
- AWSConfigServiceRolePolicy
- AWSConfigUserAccess
- AWSDataExchangeProviderFullAccess
- AWSElasticBeanstalkServiceRolePolicy
- AWSEntityResolutionConsoleFullAccess
- AWSFaultInjectionSimulatorECSAccess
- AWSFinOpsAgentServiceRolePolicy
- AWSGlueConsoleFullAccess
- AWSGlueConsoleSageMakerNotebookFullAccess
- AWSIoTSiteWiseConsoleFullAccess
- AWSLambda_FullAccess
- AWSLambda_ReadOnlyAccess
- AWSLambdaFullAccess
- AWSMcpServiceActionsFullAccess
- AWSNetworkFirewallIGWServiceRolePolicy
- AWSNetworkFirewallServiceRolePolicy
- AWSQuickSetupSchedulerPermissionsBoundary
- AWSReachabilityAnalyzerServiceRolePolicy
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSResourceGroupsReadOnlyAccess
- AWSSecurityHubServiceRolePolicy
- AWSSecurityHubV2ServiceRolePolicy
- AWSServiceCatalogAppRegistryFullAccess
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformInfrastructureExecutorAccessEC2
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- AWSWellArchitectedDiscoveryServiceRolePolicy
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- CloudWatchApplicationSignalsServiceRolePolicy
- CloudWatchAutomaticDashboardsAccess
- CloudWatchOmniAWSIntegrationPolicy
- ConsoleFullAccessFromVercel
- ConsoleViewOnlyAccessFromVercel
- EC2ImageBuilderLifecycleExecutionPolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecretsManagerReadWrite
- SecurityAudit
- ServiceQuotasFullAccess
- ServiceQuotasReadOnlyAccess
- WellArchitectedAgentResourceScanning
describereportcreation getcompliancesummary getresources gettagkeys gettagvalues listrequiredtags startreportcreation tagresources untagresources
Actions (9)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| tag:DescribeReportCreation | Read | 5 | 1 |
| tag:GetComplianceSummary | Read | 8 | 1 |
| tag:GetResources | Read | 80 | 17 |
| tag:GetTagKeys | Read | 25 | 1 |
| tag:GetTagValues | Read | 22 | 1 |
| tag:ListRequiredTags | List | 4 | 1 |
| tag:StartReportCreation | Write | 4 | 1 |
| tag:TagResources | Tagging | 7 | 2 |
| tag:UntagResources | Tagging | 7 | 2 |